A second‑order SQL injection flaw was found in the osCommerce Email Template Configuration module, specifically in EmailController.php. When an attacker manipulates the email_templates_key parameter, the application embeds it directly into an SQL statement, enabling the execution of arbitrary queries against the database. This can compromise the confidentiality, integrity, and availability of the data stored by the site. The CVSS score of 5.1 reflects a moderate severity but the existence of a public exploit raises the practical risk level.

The vulnerability affects osCommerce version 4.14.63493, as stated in the CVE description. No other specific versions are listed, but earlier releases containing the same code path may also be vulnerable.

The exploit can be triggered remotely by supplying a crafted value for the email_templates_key argument, and the public exploit has been released, making the threat real. The EPSS score is currently lower than 1%, indicating an extremely low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Attackers would likely send a custom HTTP request to the backend EmailTemplate endpoint to inject SQL; no explicit authentication requirement is mentioned, implying that the vulnerability may be exploitable without privileged access to the admin interface. Given the moderate CVSS score and the availability of an exploit, the overall risk to sites running this version of osCommerce is significant and warrants prompt action.