CVE-2019-25460 - Web Ofisi Platinum E-Ticaret v5 SQL Injection via q Parameter

Back Back to CVE browser

HIGH

Web Ofisi Platinum E-Ticaret v5 SQL Injection via q Parameter

Published Feb 22, 2026

8.8

HIGH

CVSS 4.0

EPSS 0.38%

Description

Web Ofisi Platinum E-Ticaret v5 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'q' GET parameter. Attackers can send requests to the arama endpoint with malicious 'q' values using time-based SQL injection techniques to extract sensitive database information.

Affected products

Vendor Web-ofisi Product Ticaret Default
n/a
- Version
  v5
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Web-ofisi

Ticaret

n/a

Version	Status	Constraints
v5	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-19585
Advisory
https://www.exploit-db.com/exploits/47140
exploit
https://www.vulncheck.com/advisories/web-ofisi-platinum-e-ticaret-sql-injection-via-q-parameter
third-party-advisoryBroken Link
https://www.web-ofisi.com/detay/platinum-e-ticaret-v5.html
product

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-19585		Advisory
https://www.exploit-db.com/exploits/47140		exploit
https://www.vulncheck.com/advisories/web-ofisi-platinum-e-ticaret-sql-injection-via-q-parameter		third-party-advisoryBroken Link
https://www.web-ofisi.com/detay/platinum-e-ticaret-v5.html		product