What is CVE-2019-13026?

CVE-2019-13026 is a critical-severity vulnerability in Oxid-Esales Eshop, classified under SQL Injection. CVSS score: 9.8/10. Published 2019-07-30.

How severe is CVE-2019-13026?

Critical severity. CVSS v3 base score is 9.8 out of 10.

SQL Injection in Oxid-Esales Eshop

CVE-2019-13026

OXID eShop 6.0.x before 6.0.5 and 6.1.x before 6.1.4 allows SQL Injection via a crafted URL, leading to full access by an attacker. This includes all shopping cart options, customer data, and the database. No interaction between the attacker and the victim is necessary.

Vulnerability class: SQL Injection

EPSS: 0.014 (68.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Oxid-esales Eshop
N/a — versions n/a

Weakness classification (CWE)

CWE-89 — SQL Injection

References

cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2019-13026?: CVE-2019-13026 is a critical-severity vulnerability in Oxid-Esales Eshop, classified under SQL Injection. CVSS score: 9.8/10. Published 2019-07-30.
How severe is CVE-2019-13026?: Critical severity. CVSS v3 base score is 9.8 out of 10.