Osclass CVE-2026-113381

Exploitation requires an Osclass instance at version 8.3.1 or earlier that is network-reachable, with the attacker able to reach the search/item-listing code path that passes the sPattern argument into Item::findUserItems. The CVSS vector rates this unauthenticated (PR:N) with no user interaction (UI:N) and low complexity, implying default configurations are exploitable; however the 'findUserItems' naming suggests the query may normally serve a user-item context, so whether a session is required could not be confirmed from the data and should be validated. The primary limiting factor is deployment scale - Osclass is a niche self-hosted CMS - plus the absence of a vendor patch, meaning mitigation currently depends on virtual patching (WAF) or input filtering rather than an official fix.

This is a genuine-but-moderate priority issue, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated SQL injection, which is a favorable profile for attackers; however the impact metrics are rated only Low across confidentiality, integrity and availability (VC:L/VI:L/VA:L), yielding a modest 5.5 base score. The E:P marking and the description both confirm publicly available exploit code exists, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active, widespread exploitation - the realistic posture is opportunistic scanning against an internet-exposed, niche CMS rather than mass targeted campaigns. Two signals warrant caution and verification: (1) SQL injection (CWE-89) frequently enables full database read/dump, which argues for higher confidentiality impact than the vendor-assigned VC:L - VulDB routinely under-rates SQLi impact, so treat the 5.5 as a floor; (2) the function name Item::findUserItems may imply the code path normally runs in a user/session context, yet the advisory states PR:N and 'initiated remotely' with no authentication detail, so the true authentication prerequisite could not be confirmed from the data and should be validated against the source. The vendor was contacted but did not respond, meaning no official patch or advisory is confirmed.

An attacker locates an internet-exposed Osclass classifieds site (version ≤ 8.3.1) and sends a crafted request that places malicious SQL into the sPattern search argument consumed by Item::findUserItems. Because the input is concatenated into a query without sanitization, the attacker extracts database contents such as user records and credentials. Public exploit code for this flaw is already available, lowering the skill barrier for opportunistic reuse.