| 제목 | osCommerce 4.14.63493 SQL Injection |
|---|
| 설명 | osCommerce 4.14.63493 contains authenticated second-order SQL injection vulnerabilities in backend-managed email template and language configuration workflows. A backend user with the relevant feature permissions can store crafted SQL syntax in fields such as email_templates.email_templates_key or the DEFAULT_LANGUAGE value in configuration.configuration_value. When the affected email template is saved again, or when backend language management actions are performed, these stored values are reloaded from the database and concatenated into SQL queries without sufficient second-stage escaping, parameter binding, or allowlist validation. |
|---|
| 원천 | ⚠️ https://anonymous.4open.science/r/oscommerce-E7D5/second-order-sqli-report.md |
|---|
| 사용자 | 6dAksIAdf4bjuJIv8MWq (UID 97366) |
|---|
| 제출 | 2026. 06. 08. AM 05:29 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 02. PM 11:00 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 385420 [osCommerce 4.14.63493 Email Template Configuration EmailController.php EmailController email_templates_key SQL 주입] |
|---|
| 포인트들 | 20 |
|---|