Code Injection Vulnerability in osCommerce2 Payment Page by osCommerce
CVE-2026-105225

4.8MEDIUM

Key Information:

Vendor

Oscommerce

Status
Oscommerce2
Vendor
CVE Published:
5 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-105225?

A code injection vulnerability has been identified in the osCommerce osCommerce2 Payment Page feature, specifically in the 'include' function of the 'includes/classes/payment.php' file. This vulnerability arises from improper handling of the MODULE_PAYMENT_INSTALLED argument, allowing attackers to manipulate inputs and execute arbitrary code remotely. With an exploit already made public, immediate action is necessary to mitigate risks. The osCommerce team was notified about the issue but has not yet provided a resolution.

Affected Version(s)

osCommerce2 2.3.4.0

osCommerce2 2.3.4.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-105225 - Proof of Concept

References

https://vuldb.com/vuln/413427
vdb-entrytechnical-description
https://vuldb.com/vuln/413427/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-105225
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

360alphalab (VulDB User)
VulDB CNA Team
.