CVE-2025-27892

Vulnerability

Description CVE-2025-27893 is a SQL injection vulnerability in the /api/search/order endpoint of Shopware, affecting versions prior to 6.5.8.13. The issue is a regression of previously patched vulnerabilities CVE-2024-22406 and CVE-2024-42357, indicating that the original fixes were incomplete or reintroduced during subsequent development [1][3].

Exploitation

Prerequisites An attacker can exploit this flaw by sending specially crafted requests to the vulnerable API endpoint. No authentication is required to trigger the injection, as the /api/search/order endpoint is publicly accessible in default configurations. The vulnerability allows an unauthenticated remote attacker to manipulate SQL queries executed by the application [1].

Potential

Impact Successful exploitation enables an attacker to read, modify, or delete arbitrary data in the Shopware database. This can lead to unauthorized access to customer information, order details, and other sensitive data stored in the database. In some scenarios, the attacker may also be able to escalate privileges or compromise the underlying server [1][3].

Mitigation

Status Shopware has released fixes in versions 6.5.8.13 and 6.6.5.1. For users who cannot immediately upgrade, the Shopware Security Plugin has been updated to version 2.0.11, which applies the necessary patches to older Shopware instances. Users are strongly advised to upgrade or apply the security plugin update as soon as possible [1][4].