CVE-2019-25495
Published: 27 February 2026
Summary
CVE-2019-25495 is a high-severity SQL Injection (CWE-89) vulnerability in Oscommerce Oscommerce. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2019-25495 is a SQL injection vulnerability (CWE-89) affecting osCommerce version 2.3.4.1. The issue exists in the product_reviews_write.php script, where the reviews_id parameter fails to properly sanitize input, enabling attackers to inject malicious SQL code into database queries.
Unauthenticated attackers can exploit this vulnerability remotely with low attack complexity, no privileges, and no user interaction required (CVSS:3.1 score of 8.2; AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). By crafting GET requests to product_reviews_write.php with boolean-based SQL injection payloads in the reviews_id parameter, attackers can manipulate queries to extract sensitive database information.
Advisories and additional details are available from VulnCheck at https://www.vulncheck.com/advisories/oscommerce-sql-injection-via-reviewsid-parameter, the osCommerce website at https://www.oscommerce.com, and a public exploit at https://www.exploit-db.com/exploits/46330.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19721
Vulnerability details
osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the reviews_id parameter. Attackers can send GET requests to product_reviews_write.php with malicious reviews_id values using boolean-based SQL injection payloads to…
more
extract sensitive database information.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2019-25495 is a SQL injection in a public-facing web application (osCommerce), directly enabling T1190 (Exploit Public-Facing Application). It facilitates arbitrary database queries for sensitive data extraction, mapping to T1213.006 (Data from Information Repositories: Databases).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 mandates validation of inputs like the reviews_id parameter to reject malicious SQL payloads before they are incorporated into database queries.
SI-2 requires timely remediation of flaws such as the SQL injection vulnerability in product_reviews_write.php, preventing exploitation through patching.
SI-9 enforces restrictions on information inputs like reviews_id to only permitted values (e.g., integers), blocking SQL injection attempts.