The vulnerability originates from a remote code injection flaw in the include function of includes/classes/payment.php within osCommerce osCommerce2. By manipulating the MODULE_PAYMENT_INSTALLED argument, an attacker can inject arbitrary code, leading to remote execution of malicious instructions. This weakness directly compromises the confidentiality and integrity of the system, allowing attackers to access sensitive data, alter payment processing, or establish persistence. The flaw is identified as CWE-74 (Code Injection via Include) and CWE-94 (Improper Control of Generation of Code or Process).

osCommerce osCommerce2 versions up to and including 2.3.4.1 are affected. The vulnerability resides in the Payment Page component’s payment.php file, and no specific hardware or operating system constraints are mentioned.

With a CVSS score of 4.8 the severity is moderate, yet the exploit is publicly available and can be performed remotely, indicating a realistic threat. EPSS data is not available, but the absence from the CISA KEV catalog does not diminish the risk because the vulnerability itself is demonstrated and exploitable. The attack path requires an attacker to send a crafted request that adjusts MODULE_PAYMENT_INSTALLED, so the threat is primarily against exposed web interfaces of the application.