CVE-2026-18592
Received Received - Intake

SQL Injection in osCommerce Email Template Configuration

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: VulDB

Description
A security flaw has been discovered in osCommerce 4.14.63493. Affected by this issue is the function EmailController of the file app/lib/backend/controllers/EmailController.php of the component Email Template Configuration. Performing a manipulation of the argument email_templates_key results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-18592
EUVD
EUVD-2026-52221

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
oscommerce oscommerce 4.14.63493

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a SQL injection flaw in osCommerce version 4.14.63493. It exists in the EmailController.php file within the Email Template Configuration component. The issue arises from improper handling of the email_templates_key argument, allowing attackers to manipulate it to inject malicious SQL code. The exploit is publicly available and can be executed remotely.

Detection Guidance

Detecting SQL injection vulnerabilities like CVE-2026-18592 requires inspecting web application logs for unusual input patterns in the email_templates_key parameter. Check for requests containing SQL syntax such as ' OR 1=1 -- or UNION SELECT. Use tools like sqlmap to test if the parameter is vulnerable by injecting test payloads.

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary SQL commands on the database. This may lead to unauthorized data access, modification, or deletion. Attackers could steal sensitive information such as customer details, order data, or administrative credentials. The impact depends on the database permissions and the attacker's goals.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by exposing personal or health data. GDPR requires protection of personal data, and a breach could result in fines. HIPAA mandates safeguards for health information, and a breach may lead to penalties. Affected organizations must address this flaw to maintain compliance.

Mitigation Strategies

Immediately update osCommerce to the latest patched version if available. If no patch exists, disable the EmailController component or restrict access to the vulnerable file app/lib/backend/controllers/EmailController.php. Monitor network traffic for unusual SQL queries targeting the email_templates_key parameter.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18592. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart