A critical SQL injection vulnerability in osCommerce 2.3.4.1 allows unauthenticated remote attackers to manipulate database queries and potentially exfiltrate sensitive data.

This is a SQL injection (CWE-89) vulnerability occurring within the currency parameter of the shopping_cart.php script. The application fails to properly sanitize user input, allowing an unauthenticated attacker to execute arbitrary boolean-based SQL commands against the backend database.

The ability for an unauthenticated user to interact directly with the database poses a severe risk to data confidentiality and integrity. Successful exploitation could lead to the unauthorized extraction of customer records, administrative credentials, or other sensitive business information stored within the database. Given the CVSS score of 8.2, this vulnerability is classified as High severity and should be prioritized for immediate remediation to prevent potential data breaches.

Immediate Action: Upgrade to the latest version of osCommerce or apply the vendor-supplied security patches to address the input sanitization flaw. If an update is not immediately feasible, restrict access to the shopping_cart.php endpoint via network-level controls.

Proactive Monitoring: Review web server access logs for anomalous GET requests to shopping_cart.php containing SQL syntax patterns, such as the use of single quotes or database-specific keywords like UNION, SELECT, or OR.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection patterns and filter malicious payloads targeting the currency parameter.

Public Exploit Available: Yes, a functional proof-of-concept exists in the Exploit Database (EDB-ID 46328).

This vulnerability represents a significant security risk due to the ease of exploitation and the potential for full database compromise. Organizations utilizing osCommerce 2.3.4.1 must treat this as a high-priority task. Ensure that the software is updated to a patched version immediately, and verify that all internet-facing instances are protected by robust input validation and WAF configurations to mitigate the risk of exploitation.