github.com
https://github.com/shopware/shopware CVE-2025-27892
MEDIUMNuclei
Shopware Vulnerable to Blind SQL-injection in DAL aggregations
Record summary
CVE-2025-27892 has a selected CVSS score of 6.8 (medium); EIP currently links 1 Nuclei template.
Description
Shopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the /api/search/order endpoint. NOTE: this issue exists because of a CVE-2024-22406 and CVE-2024-42357 regression.
Description source: CVE List
Exploitation context
Available material
- Nuclei templates
- 1
CISA SSVC decision
ExploitationPoC
AutomatableYes
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 16, 2025 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
shopware/coreBrowse Packagist / shopware/core | GitHub Advisory | 6.7.0.0-rc1 | affected |
| 6.7.0.0-rc1 to < 6.7.0.0-rc2 · Fixed in 6.7.0.0-rc2 | affected | ||
| 6.6.0.0 to < 6.6.10.3 · Fixed in 6.6.10.3 | affected | ||
| Before 6.5.8.18 · Fixed in 6.5.8.18 | affected | ||
shopware/platformBrowse Packagist / shopware/platform | GitHub Advisory | 6.7.0.0-rc1 | affected |
| 6.7.0.0-rc1 to < 6.7.0.0-rc2 · Fixed in 6.7.0.0-rc2 | affected | ||
| 6.6.0.0 to < 6.6.10.3 · Fixed in 6.6.10.3 | affected | ||
| Before 6.5.8.18 · Fixed in 6.5.8.18 | affected |
Nuclei templates
1ProjectDiscoveryCRITICALShopware < 6.5.8.13 - SQL InjectionCVSS 6.8
The Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the parameters in the "aggregations" object. The name field in this "aggregations" in nested object is vulnerable SQL-injection and can be exploited using SQL parameters.
Impact
Authenticated attackers can execute arbitrary SQL queries through the aggregations parameter in the search API, potentially extracting sensitive data from the Shopware database.
Remediation
Upgrade to Shopware version 6.5.8.13 or later that properly sanitizes the aggregations parameter.
WeaknessesCWE-89
Authorsiamnoooob, rootxharsh, pdresearch
Template tagscvecve2025shopwaresqlitime-based-sqlivuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
https://www.redteam-pentesting.de/en/advisories/rt-sa-2025-001/ https://nvd.nist.gov/vuln/detail/CVE-2025-27892
Source: ProjectDiscovery
References
7github.com
https://github.com/shopware/shopware/releases/tag/v6.5.8.17 github.com
https://github.com/shopware/shopware/releases/tag/v6.6.10.3 github.com
https://github.com/shopware/shopware/releases/tag/v6.7.0.0-rc2 github.com
https://github.com/shopware/shopware/security/advisories/GHSA-8g35-7rmw-7f59 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2025-27892 redteam-pentesting.de
https://www.redteam-pentesting.de/en/advisories/rt-sa-2025-001