Shopware is an open headless commerce platform. The Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the parameters in the “aggregations” object. The ‘name’ field in this “aggregations” object is vulnerable SQL-injection and can be exploited using time-based SQL-queries. This issue has been addressed and users are advised to update to Shopware 6.5.7.4. For older versions of 6.1, 6.2, 6.3 and 6.4 corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
The search function in Shopware API allows aggregating results using parameters passed in the 'aggregations' object. The 'name' field in this object is not properly sanitized, which allows injection of malicious SQL queries. An attacker can exploit the time-based SQL injection technique — by manipulating server response time — to gradually read the database contents without requiring a direct error response.
An attacker can gain unauthorized access to sensitive data stored in the Shopware instance database, including customer data, orders, and configuration. The network vector without required authentication significantly increases the scope of potential attack.
Shopware should be updated to version 6.5.7.4 or newer. For older branches (6.1, 6.2, 6.3, 6.4), the vendor has provided appropriate security measures in the form of a plugin — it should be installed according to the vendor's documentation. Migration to the latest Shopware version is recommended.
Shopware 6 in versions 6.1, 6.2, 6.3, 6.4, and 6.5.x before 6.5.7.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:LShopware
APPShopware< 6.5.7.4
Related vulnerabilities
Shopware: RCE przez wykonanie dowolnego kodu PHP w filtrach Twig
Shopware Store-API — wyciek informacji (information disclosure)
RCE w Shopware — podatny skrypt backend/Login/load/
Shopware is an open commerce platform. Prior to 6.7.8.1 and 6.6.10.15, an insufficient check on the filter typ...
Shopware is an open commerce platform. Prior to 6.6.10.15 and 6.7.8.1, a vulnerability in the Shopware app reg...