A critical SQL injection vulnerability in osCommerce 2.3.4.1 allows unauthenticated attackers to exfiltrate sensitive database information.

The application fails to properly sanitize the products_id parameter in the product_info.php script. This flaw permits unauthenticated attackers to append malicious boolean-based SQL injection payloads to legitimate requests, enabling the extraction of data from the underlying database.

Successful exploitation of this vulnerability poses a severe risk to data confidentiality. An attacker can perform unauthorized database queries to exfiltrate customer data, administrative credentials, or store configurations, leading to significant reputational damage and potential regulatory non-compliance. With a CVSS score of 8.2, this vulnerability is classified as High severity due to its ease of exploitation and the potential for unauthorized data access.

Immediate Action: Upgrade to the latest stable version of osCommerce that incorporates a fix for this SQL injection vulnerability. If an immediate update is not feasible, restrict access to the affected script.

Proactive Monitoring: Monitor web server access logs for anomalous GET requests targeting product_info.php that contain SQL syntax characters such as single quotes, comment indicators, or boolean logic keywords.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns in URL parameters to mitigate the risk while awaiting a permanent patch.

Public Exploit Available: Yes, a functional proof-of-concept exists via ExploitDB entry 46329.

Given the availability of a public exploit and the ease with which this vulnerability can be triggered by unauthenticated actors, organizations must prioritize the remediation of this flaw. Administrators should verify their current version and apply the necessary updates immediately to prevent unauthorized data exposure.