{"id":"CVE-2025-27892","published":"2025-04-15T00:00:00Z","modified":"2025-04-16T18:32:23Z","title":"Shopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the /api/search/order endpoint","vendor":null,"product":null,"tier":"tail","description":{"text":"Shopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the /api/search/order endpoint. NOTE: this issue exists because of a CVE-2024-22406 and CVE-2024-42357 regression.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.8,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.12929,"percentile":0.96296,"provenance":"source"},"cwes":[{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command"}],"references":[{"url":"https://github.com/shopware/shopware/security/advisories/GHSA-8g35-7rmw-7f59","tags":[]},{"url":"https://www.redteam-pentesting.de/en/advisories/rt-sa-2025-001/","tags":[]}],"priority":{"score":29.0,"factors":[{"name":"EPSS percentile","points":19.26},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":4.76}]},"exploitSources":{"nuclei":[{"id":"CVE-2025-27892","name":"Shopware < 6.5.8.13 - SQL Injection","severity":"critical","path":"http/cves/2025/CVE-2025-27892.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-27892.yaml"}],"provenance":"source"},"affected":[{"ecosystem":"Packagist","package":"shopware/core","vulnerableRanges":[">=6.7.0.0-rc1, <6.7.0.0-rc2",">=6.6.0.0, <6.6.10.3","<6.5.8.18"],"patched":["6.7.0.0-rc2","6.6.10.3","6.5.8.18"],"from":["GHSA-8g35-7rmw-7f59"],"provenance":"source"},{"ecosystem":"Packagist","package":"shopware/platform","vulnerableRanges":[">=6.7.0.0-rc1, <6.7.0.0-rc2",">=6.6.0.0, <6.6.10.3","<6.5.8.18"],"patched":["6.7.0.0-rc2","6.6.10.3","6.5.8.18"],"from":["GHSA-8g35-7rmw-7f59"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-10294","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-shopware-cve-2024-22406","parents":[{"from":"CVE-2024-22406","to":"CVE-2025-27892","relation":"regression","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"regression","quote":"NOTE: this issue exists because of a CVE-2024-22406 and CVE-2024-42357 regression.","from":"CVE.org","in":"CVE-2025-27892"}]},{"from":"CVE-2024-42357","to":"CVE-2025-27892","relation":"regression","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"regression","quote":"NOTE: this issue exists because of a CVE-2024-22406 and CVE-2024-42357 regression.","from":"CVE.org","in":"CVE-2025-27892"}]}],"packageHistory":[{"cve":"CVE-2024-42355","published":"2024-08-08","fixed":"6.6.5.1","kev":false},{"cve":"CVE-2024-42356","published":"2024-08-08","fixed":"6.6.5.1","kev":false},{"cve":"CVE-2024-42357","published":"2024-08-08","fixed":"6.6.5.1","kev":false},{"cve":"CVE-2025-27892","published":"2025-04-15","fixed":"6.7.0.0-rc2","kev":false},{"cve":"CVE-2025-30150","published":"2025-04-08","fixed":"6.7.0.0-rc2","kev":false},{"cve":"CVE-2025-30151","published":"2025-04-08","fixed":"6.7.0.0-rc2","kev":false},{"cve":"CVE-2025-32378","published":"2025-04-09","fixed":"6.7.0.0-rc2","kev":false,"link":{"from":"CVE-2025-32378","to":"CVE-2025-27892","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:shopware/platform","fromFixed":"6.5.8.17","toFixed":"6.5.8.18","daysApart":6},{"kind":"version-step","provenance":"source","package":"Packagist:shopware/core","fromFixed":"6.5.8.17","toFixed":"6.5.8.18","daysApart":6}]}}],"package":"Packagist:shopware/platform"}}