Which versions of PHP are affected by CVE-2019-25507?

Ashop Shopping Cart Software contains a critical SQL injection vulnerability that allows attackers to bypass authentication and directly manipulate your database without credentials.

Is there a public PoC exploit available for CVE-2019-25507?

Yes, a public proof-of-concept exploit is available for CVE-2019-25507. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2019-25507?

Within 24 hours: Inventory all systems running Ashop Shopping Cart and isolate affected instances from public internet access if possible. Within 7 days: Implement WAF rules to block SQL injection patterns in the 'shop' parameter, enable database activity monitoring, and review recent access logs for exploitation signs. Within 30 days: Contact vendor for patch availability timeline, evaluate migration to alternative shopping cart solutions, and conduct forensic analysis if compromise is suspected.

PHP CVE-2019-25507

Q: What is the CVSS score of CVE-2019-25507?

CVE-2019-25507 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

HIGH

SQL Injection (CWE-89)

2026-03-04 disclosure@vulncheck.com

PHP SQLi

8.8

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 15, 2026 - 15:22 NVD

8.2 (HIGH) 8.8 (HIGH)

Analysis Generated

Mar 12, 2026 - 22:05 vuln.today

PoC Detected

Mar 05, 2026 - 19:39 vuln.today

Public exploit code

CVE Published

Mar 04, 2026 - 18:16 nvd

HIGH 8.2

DescriptionCVE.org

Ashop Shopping Cart Software contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'shop' parameter. Attackers can send GET requests to index.php with malicious 'shop' values using UNION-based SQL injection to extract sensitive database information.

AnalysisAI

Technical ContextAI

Classified as CWE-89 (SQL Injection). Ashop Shopping Cart Software contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'shop' parameter. Attackers can send GET requests to index.php with malicious 'shop' values using UNION-based SQL injection to extract sensitive database information.

Affected ProductsAI

Ashop Shopping Cart Software contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.