Cloudanix VulnDB

CVE-2025-27892

High · 7.3

Shopware Vulnerable to Blind SQL-injection in DAL aggregations

CVSS

7.3

EPSS

12.9%

Published

Apr 8, 2025

CISA due date

—

The record

The Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the parameters in the “aggregations” object. The ‘name’ field in this “aggregations” **in nested** object is vulnerable SQL-injection and can be exploited using SQL parameters.

Affected packages

Ecosystem Package Introduced Fixed
Packagist shopware/core 0 6.5.8.18
Packagist shopware/core 6.6.0.0 6.6.10.3
Packagist shopware/core 6.7.0.0-rc1 6.7.0.0-rc2
Packagist shopware/platform 0 6.5.8.18
Packagist shopware/platform 6.6.0.0 6.6.10.3
Packagist shopware/platform 6.7.0.0-rc1 6.7.0.0-rc2
packagist shopware/core 6.6.0.0 6.6.10.3
packagist shopware/core 6.7.0.0-rc1 No fix
packagist shopware/core 6.7.0.0-rc1 6.7.0.0-rc2
packagist shopware/platform 6.6.0.0 6.6.10.3
packagist shopware/platform 6.7.0.0-rc1 No fix
packagist shopware/platform 6.7.0.0-rc1 6.7.0.0-rc2

Related vulnerabilities