| 제목 | OsclassPoint.com (Osclass) Osclass v8.3.1 SQL Injection — CWE-89 |
|---|
| 설명 | Title: Osclass Osclass Item Model — Unauthenticated SQL Injection via sPattern on Public User Profile
CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description:
Location:
oc-includes/osclass/controller/user-non-secure.php:228 (Params::getParamsAsArray)
oc-includes/osclass/controller/user-non-secure.php:254 ($options['pattern'] = $params['sPattern'])
oc-includes/osclass/controller/user-non-secure.php:330 (Item::findUserItems)
oc-includes/osclass/model/Item.php:665 (pattern=trim((string)options['pattern']))
oc-includes/osclass/model/Item.php:686 (sprintf MATCH ... AGAINST BOOLEAN MODE)
oc-includes/osclass/model/Item.php:689 (sprintf MATCH ... AGAINST NATURAL LANGUAGE MODE)
oc-includes/osclass/model/Item.php:692 (sprintf LIKE '%%%s%%')
What the bug is:
Osclass exposes a public user profile page at index.php?page=user&action=pub_profile routed through CWebUserNonSecure (which extends BaseModel, not SecBaseModel), so no authentication is required (index.php L255-258). The controller collects all request parameters via Params::getParamsAsArray() (L228) and, if sPattern is present, assigns it directly to $options['pattern'] (L254) with no escaping or sanitisation. This options array is passed to Item::findUserItems() (L330), where $pattern is extracted from $options['pattern'] (L665) — again without calling $this->dao->escapeStr() — and interpolated directly into a SQL MATCH ... AGAINST('%s') or LIKE '%%%s%%' clause via sprintf (L686, L689, L692). By contrast, the front-end search controller (search.php L379) sanitises sPattern with strip_tags() and routes it through Search::addPattern(), which calls $this->dao->escapeStr() before storage (Search.php L1037). The public profile code path reuses the same parameter name but bypasses both safeguards — a classic parallel-code-path blind spot. The default search_pattern_method preference is an empty string (basic_data.sql L229), which selects the BOOLEAN MODE branch (L685-686), but the LIKE branch (L691-692) is equally injectable when the administrator sets the method to like.
CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5 High.
How to exploit:
Step 1 — Identify a valid user id on the target Osclass instance (any listing shows the seller's profile link)
curl -s 'https://osclass.example.com/index.php?page=user&action=pub_profile&id=1'
Step 2 — Inject a boolean-based SQL payload via the sPattern parameter to extract data
curl -s 'https://osclass.example.com/index.php?page=user&action=pub_profile&id=1&sPattern=%27)%20OR%201=1%20OR%20MATCH(d.s_title,d.s_description)%20AGAINST(%27'
Step 3 — Observe the response
A successful injection returns all items belonging to user id 1 (because OR 1=1 is true), while a normal request with an empty or non-matching sPattern returns fewer or zero items. The difference in item count confirms the SQL injection. Time-based payloads such as ') OR SLEEP(5) OR MATCH(d.s_title,d.s_description) AGAINST(' can be used for blind extraction when the page does not reflect query results.
The PoC documents the exploitability, not the exploitation.
Impact:
An unauthenticated remote attacker can extract arbitrary data from the Osclass database, including user credentials (hashed passwords in t_user), email addresses, private listings, and admin account details.
The injection point is on a public page reachable by anyone — no account, cookie, or API key is required — making it trivially exploitable by automated scanners.
Because the LIKE branch (L692) uses %%%s%% formatting, an attacker can use standard UNION-based or error-based techniques to enumerate the full database schema and exfiltrate all tables.
The same unsanitised sPattern parameter is also processed by countUserItems() (L331 → Item.php L947+), providing a second injection point that can be used for time-based blind extraction even when the listing page is cached or empty. |
|---|
| 원천 | ⚠️ https://github.com/osclass-classifieds/Osclass |
|---|
| 사용자 | c0rrup1_1 (UID 101347) |
|---|
| 제출 | 2026. 09. 18. PM 01:47 (1 월 ago) |
|---|
| 모더레이션 | 2026. 10. 20. AM 06:25 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 422654 [Osclass 까지 8.3.1 Item Model Item.php Item::findUserItems sPattern SQL 주입] |
|---|
| 포인트들 | 20 |
|---|