Oscommerce2
Monthly
Code injection in osCommerce2 (versions through 2.3.4.1) allows an attacker who already holds high backend privileges - a store administrator able to edit the payment configuration - to manipulate the MODULE_PAYMENT_INSTALLED parameter and have attacker-controlled content pulled into a PHP include() in includes/classes/payment.php. Because the CVSS 4.0 vector carries PR:H and UI:P, the vulnerable payment flow is not reachable by an anonymous shopper and requires at least passive user interaction, which keeps this a medium-severity, post-authentication issue (base score 4.8) rather than a pre-auth remote takeover. Publicly available exploit code exists, and there is no confirmed upstream fix because the project has not responded to the reporter's early notification; no EPSS or CISA KEV signal is available for this CVE.
Code injection in osCommerce2 (versions through 2.3.4.1) allows an attacker who already holds high backend privileges - a store administrator able to edit the payment configuration - to manipulate the MODULE_PAYMENT_INSTALLED parameter and have attacker-controlled content pulled into a PHP include() in includes/classes/payment.php. Because the CVSS 4.0 vector carries PR:H and UI:P, the vulnerable payment flow is not reachable by an anonymous shopper and requires at least passive user interaction, which keeps this a medium-severity, post-authentication issue (base score 4.8) rather than a pre-auth remote takeover. Publicly available exploit code exists, and there is no confirmed upstream fix because the project has not responded to the reporter's early notification; no EPSS or CISA KEV signal is available for this CVE.