CVE-2019-25507 HIGH

CVE-2019-25507: Ashop Shopping Cart Software Lastest SQL Injection via index.php

Vendor Ashopsoftware

Product Ashop Shopping Cart Software

Weakness CWE-89 · SQLi

Published March 4, 2026

Last update April 7, 2026

View on NVD All CVEs

CVSS base score

8.8/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

Description

Ashop Shopping Cart Software contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'shop' parameter. Attackers can send GET requests to index.php with malicious 'shop' values using UNION-based SQL injection to extract sensitive database information.

Key dates

Disclosure timeline

March 4, 2026 CVE published

April 7, 2026 Record updated