PT-2025-15894 · Shopware · Shopware

Published

2025-04-08

·

Updated

2025-04-29

·

CVE-2025-27892

CVSS v3.1

6.8

Medium

VectorAV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
Name of the Vulnerable Software and Affected Versions Shopware versions prior to 6.6.10.3 Shopware versions prior to 6.5.8.17
Description The Shopware application API contains a search functionality that enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the parameters in the "aggregations" object. The name field in this "aggregations" object is vulnerable to SQL injection and can be exploited using SQL parameters.
Recommendations Update to Shopware 6.6.10.3 or 6.5.8.17 to resolve the issue. For older versions of 6.4, consider installing a security plugin to mitigate the risk. As a temporary workaround, consider restricting access to the vulnerable search functionality until a patch is applied.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-27892
GHSA-8G35-7RMW-7F59

Affected Products

Shopware