As part of our regular security audit, the following issue has been identified:
Specially crafted SQL statements can lead to unauthorized access to the database.
Resolved in current OXID eShop release 4.1.6. Fix for previous major releases will be available soon.
By sending specially crafted SQL statements, unauthorized users may gain access to sensitive information stored in the database.
No exploits are known as of today.
Affected products, releases and platforms
- OXID eShop Professional Edition
- OXID eShop Enterprise Edition
- OXID eShop Community Edition
- Professional, Enterprise and Community Edition: 18.104.22.168_13895, 22.214.171.124_13934, 126.96.36.199_14260, 188.8.131.52_14455, 184.108.40.206_14842, 220.127.116.11_14967, 18.104.22.168_15990, 4.1.0, 4.1.1, 4.1.2, 4.1.3, 4.1.4 and 4.1.5
- Enterprise Edition: in addition to the above, all 2.x versions
- Professional Edition: in addition to the above, all 3.x versions
- Above releases are affected on all platforms.
Note: Older releases than the ones mentioned might as well be affected. They are considered end of life and will not be supported.
The issue has been addressed in the following releases:
- OXID eShop Professional Edition version 4.1.6
- OXID eShop Enterprise Edition version 4.1.6
- OXID eShop Community Edition version 4.1.6
For the legacy release OXID eShop Professional Edition 22.214.171.124 and Enterprise Edition 126.96.36.199, a separate fix will be made available shortly after the release of this security bulletin.
Note: Users of the legacy < 188.8.131.52 and < 184.108.40.206 releases will first have to install the latest update in order to apply the fix.
The security issue has been found during one of our regular security audits.
How to report security issues
Learn how to report security issues in the Security overview page.