Description
An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage. This issue is fixed in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Magento | Magento Open Source | prior to 1.9.4.1 | — |
| Magento | Magento Commerce | prior to 1.14.4.1 | — |
| Magento | Magento | prior to 2.1.17, prior to 2.2.8, prior to 2.3.1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
0xSemZ/Magento-CVE-2019-7139-SQLi-PoC ★ 8 · Jul 22, 2025
Proof-of-Concept (PoC) exploit for CVE-2019-7139, an unauthenticated SQL injection vulnerability in Magento (PRODSECBUG-2198). For educational and security research purposes only. Use with explicit p…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Magento - SQL Injection http/cves/2019/CVE-2019-7139.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | magento/community-edition | >= 2.1.0, < 2.1.18 | 2.1.18 | GHSA-4j6w-9rf8-hg7r |
| Packagist | magento/community-edition | >= 2.2.0, < 2.2.9 | 2.2.9 | GHSA-4j6w-9rf8-hg7r |
| Packagist | magento/community-edition | >= 2.3.0, < 2.3.2 | 2.3.2 | GHSA-4j6w-9rf8-hg7r |