EUVD-2026-52221
GHSA-fc65-w3rc-9v2m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Admin backend reachable over network (AV:N), but PR:H reflects mandatory admin authentication; limited C/I/A impact consistent with constrained second-order SQLi scope against a single application database.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A security flaw has been discovered in osCommerce 4.14.63493. Affected by this issue is the function EmailController of the file app/lib/backend/controllers/EmailController.php of the component Email Template Configuration. Performing a manipulation of the argument email_templates_key results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Second-order SQL injection in osCommerce 4.14.63493 allows remote attackers with high-privilege (administrator-level) backend access to manipulate the email_templates_key parameter in the Email Template Configuration component, enabling database extraction and modification. Public exploit code is confirmed available via an anonymous repository hosting a detailed second-order SQLi report. No vendor patch exists - the vendor did not respond to responsible disclosure - raising operational risk for any organization still running this version despite the PR:H constraint.
Technical ContextAI
osCommerce is a PHP-based open-source e-commerce platform. The vulnerability resides in app/lib/backend/controllers/EmailController.php within the EmailController function, specifically in how the email_templates_key argument is handled during Email Template Configuration operations. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) - user-supplied input is incorporated into a SQL query without parameterized statements or adequate escaping. The exploit report title references 'second-order SQL injection,' indicating the payload is stored during one operation and executed during a subsequent retrieval or processing step, which can bypass input validation applied only at the initial entry point. CPE data (cpe:2.3:a:n/a:oscommerce:*:*:*:*:*:*:*:*) does not constrain the version range, suggesting the vulnerability pattern may exist in adjacent versions beyond the confirmed 4.14.63493 build.
RemediationAI
No vendor-released patch is available at time of analysis - the vendor did not respond to responsible disclosure, and no fix version has been confirmed. Organizations running osCommerce 4.14.63493 should immediately restrict administrative backend access to trusted IP addresses or internal VPN-only networks, eliminating the network-accessible attack surface for the vulnerable endpoint; the trade-off is reduced remote administration convenience. Deploy a web application firewall (WAF) with SQL injection detection rules targeting the /EmailController endpoint, noting that second-order injection patterns may partially evade signature-based detection since the payload is stored before execution. Internally, apply manual code remediation to app/lib/backend/controllers/EmailController.php by replacing direct string interpolation of email_templates_key with parameterized prepared statements - this is the definitive fix if development resources allow. Audit database user privileges granted to the osCommerce application and enforce least-privilege (read-only where possible) to limit the impact of successful exploitation. Monitor VulDB at https://vuldb.com/vuln/385420 for any future vendor patch release.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today