An unauthenticated SQL injection vulnerability in osCommerce 2.3.4.1 allows remote attackers to extract sensitive database information, posing a significant risk to data confidentiality.

This flaw is a SQL injection (CWE-89) occurring in the product_reviews_write.php script. Unauthenticated attackers can inject malicious SQL commands through the reviews_id parameter to perform boolean-based data extraction from the backend database.

Successful exploitation of this vulnerability can lead to the unauthorized disclosure of sensitive information stored within the osCommerce database, including customer details, order history, or administrative credentials. Given the CVSS score of 8.2, this vulnerability is classified as High severity. The ability for an unauthenticated attacker to remotely query the database significantly increases the risk of large-scale data breaches and regulatory non-compliance.

Immediate Action: As there is no official vendor patch available for this legacy version, administrators should immediately restrict access to the vulnerable product_reviews_write.php endpoint or disable the reviews functionality entirely.

Proactive Monitoring: Security teams should audit web server access logs for anomalous GET requests containing SQL syntax or unusual characters within the reviews_id parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection patterns targeting the reviews_id parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the Exploit-DB entry 46330.

Due to the lack of a vendor-supplied patch and the availability of public exploit code, this vulnerability presents a persistent risk to any environment still running osCommerce 2.3.4.1. Organizations are strongly advised to migrate to a modern, supported e-commerce platform. If migration is not immediately feasible, ensure that rigorous WAF protections and restrictive access controls are implemented to mitigate the risk of unauthorized database access.