CyberRota Analysis
AI-GeneratedA SQL injection vulnerability exists in the EmailController function of the Email Template Configuration component in osCommerce 4.14.63493, allowing remote attackers to manipulate the email_templates_key argument. This flaw could lead to unauthorized access to sensitive data or database manipulation. Organizations using this version of osCommerce should prioritize applying security updates to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A security flaw has been discovered in osCommerce 4.14.63493. Affected by this issue is the function EmailController of the file app/lib/backend/controllers/EmailController.php of the component Email Template Configuration. Performing a manipulation of the argument email_templates_key results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.