# CVE-2019-9762: PHPSHE - SQLi

> Live exploitation tracking for CVE-2019-9762 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2019-9762

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** PHPSHE
- **Weaknesses:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
- **Tags:** php, ecommerce

## Description

A SQL Injection was discovered in PHPSHE 1.7 in include/plugin/payment/alipay/pay.php with the parameter id. The vulnerability does not need any authentication.

## CrowdSec analysis

[CVE-2019-9762](https://euvd.enisa.europa.eu/vulnerability/CVE-2019-9762) is a critical SQL injection vulnerability in PHPSHE 1.7, specifically within the alipay payment plugin's pay.php file using the id parameter. This flaw allows unauthenticated attackers to execute arbitrary SQL commands on the backend database, potentially leading to data theft, data manipulation, or full system compromise.

CrowdSec has been tracking this vulnerability and its exploits since 21st of January 2026.

CrowdSec network observations suggest that most exploitation of CVE-2019-9762 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2019-9762. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Attackers exploit this vulnerability by sending crafted requests to `/include/plugin/payment/alipay/pay.php` with malicious SQL code injected into the `id` parameter. This allows unauthenticated users to execute arbitrary SQL commands against the backend database.

## Timeline

- 2019-03-14: CVE Published. CVE-2019-9762 is published to NVD.
- 2026-01-21: Rule Released. CrowdSec releases a rule to detect CVE-2019-9762 exploitation attempts against the CrowdSec Network.
- 2026-01-30: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2019-9762 for the first time.

## References

- https://gitee.com/koyshe/phpshe/issues/ITC0C
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9762.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2019-9762) follows observed exploitation activity for CVE-2019-9762. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.