CVE-2019-25495

osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the reviewsid parameter. Attackers can send GET requests to productreviewswrite.php with malicious reviewsid values using boolean-based SQL...

CVE-2019-25495

osCommerce 2.3.4.1 contains a SQL injection vulnerability exploitable via the reviews_id parameter in product_reviews_write.php. Unauthenticated attackers can craft GET requests with boolean-based payloads to influence database queries and potentially exfiltrate data. CVSS vectors indicate high i...