VYPR
← All advisories
Unrated severityNVD Advisory· Published Feb 27, 2026· Updated Apr 7, 2026

osCommerce 2.3.4.1 SQL Injection via products_id Parameter

CVE-2019-25496

Description

osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the products_id parameter. Attackers can modify the products_id value in product_info.php requests and append boolean-based SQL injection payloads to extract sensitive database information.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • OsCommerce/Oscommercellm-fuzzy2 versions
    = 2.3.4.1+ 1 more
    • (no CPE)range: = 2.3.4.1
    • (no CPE)range: 2.3.4.1

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.