Osclass: SQL Injection in Item Model Handler (CVE-2026-113381)

Osclass versions up to 8.3.1 contain a critical SQL injection vulnerability in the Item::findUserItems function, located within the file 'oc-includes/osclass/model/Item.php'. The vulnerability arises from improper sanitization of the 'sPattern' argument passed to the Item Model Handler. A remote attacker can exploit this flaw by submitting crafted input to the affected parameter, potentially allowing unauthorized access to the database or sensitive information disclosure. Public exploit code for this vulnerability is currently available, posing an immediate risk to installations that have not implemented compensating controls. Despite early disclosure attempts, the vendor has not responded or provided a patch, leaving legacy versions susceptible to exploitation.

Impact

Successful exploitation of this SQL injection vulnerability allows remote attackers to manipulate backend database queries, which could lead to unauthorized data extraction, database modification, or complete compromise of the underlying database application. Organizations running Osclass versions 8.3.1 or older are at risk of data breach and loss of service integrity.

Recommendation

• Identify all public-facing instances of Osclass version 8.3.1 or older and restrict access to the web interface via a Web Application Firewall (WAF) until the vulnerability is addressed by the vendor or internal patches are applied.
• Implement strict input validation on the application layer for the 'sPattern' parameter to ensure it does not contain malicious SQL metacharacters.
• Monitor database query logs for unusual syntax patterns, such as UNION statements or comment indicators, originating from web traffic to the application.