UpHeron
All vulnerabilities

Servers and applications

CVE-2024-22406

Blind SQL-injection in DAL aggregations

Severity
Critical 9.8
Published
16 Jan 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
6.5.7.4
Also known as
GHSA-qmp9-2xwj-m6m9
Sources
NVD, Project advisories (GitHub)

Description

Shopware is an open headless commerce platform. The Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the parameters in the “aggregations” object. The ‘name’ field in this “aggregations” object is vulnerable SQL-injection and can be…

Affected software

SoftwareAffected versions
ShopwareServers and applications · cpe:a:shopware:shopware
  • Every version before 6.5.7.4
ShopwareServers and applications · github:shopware/shopware
  • Every version before 6.5.7.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-22406
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-22406
  • GitHub Advisory Database https://github.com/advisories/GHSA-qmp9-2xwj-m6m9
  • github.com https://github.com/shopware/shopware/security/advisories/GHSA-qmp9-2xwj-m6m9