{"id":"CVE-2026-113381","kind":"vulnerability","aliases":["CVE-2026-113381"],"related":[],"title":"Osclass: SQL injection in item search lets remote attackers read the database","description":"A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the component Item Model Handler. This manipulation of the argument sPattern causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"Osclass up to 8.3.1 fails to sanitize the sPattern argument in Item::findUserItems, so a crafted value is run as SQL. A remote attacker can read or change data in the site's database, and a public exploit exists.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"osclass","fixed":["8.4.0"],"affected":"<= 8.3.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["classifieds","mysql","osclass","package","php","self-hosted","unauthenticated"],"not_affected_if":["newer-version","osclass-8.4.0-or-later","spattern-filtered-at-waf"],"how_to_check":"- Check the Osclass version (admin dashboard, or OSCLASS_VERSION in oc-includes/osclass/default-constants.php or similar); 8.3.1 and earlier are affected, and the forum reporter says 8.3.0 is too.\n- In oc-includes/osclass/model/Item.php, findUserItems(): if $pattern is put into the MATCH(...) AGAINST('%s') or like '%%%s%%' sprintf calls without $this->dao->escapeStr(), the site is vulnerable.\n- Look in web logs for requests to /user/profile/ (or page=user&action=pub_profile) with sPattern containing quotes, UNION, SLEEP or --.","fix":"Upgrade to Osclass 8.4.0 (released 2 Oct 2026; maintainer said the sPattern bug would be fixed in 8.4, the changelog I read does not confirm it). Until then, block or sanitize the sPattern and sOrder query parameters on /user/profile/ at the web server or WAF.","status":"open","published_at":"2026-10-20T10:17:05+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:22:46+00:00","updated_at":"2026-10-25T03:35:01+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:22:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Osclass: SQL injection in item search lets remote attackers read the database","impact":"high","summary":"Osclass up to 8.3.1 fails to sanitize the sPattern argument in Item::findUserItems, so a crafted value is run as SQL. A remote attacker can read or change data in the site's database, and a public exploit exists.","category":"package","nicknames":[],"who_cares":["osclass","php","self-hosted","mysql"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads or alters the site database remotely","analyst_note":"Find the patched Osclass release and vendor advisory, and confirm which public pages reach findUserItems and whether authentication is required.","how_to_check":"- Check the installed Osclass version in the application's version file or admin dashboard; anything at or below `8.3.1` is in scope.\n- Find the file `oc-includes/osclass/model/Item.php` and confirm whether `findUserItems` passes `sPattern` into a query without escaping.","needs_analyst":true,"not_affected_if":["newer-version"],"who_is_affected":"Any Osclass installation at version 8.3.1 or earlier that is reachable from the internet is potentially exposed, since the flaw is triggered through the item search path. The sources do not say which front-end pages or parameters reach the vulnerable function, nor whether a login is needed. Sites running a newer release or with the vulnerable path blocked at the web server may be able to skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000612,"input_tokens":3349,"output_tokens":555,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the patched Osclass release and vendor advisory, and confirm which public pages reach findUserItems and whether authentication is required.","search":"'-113381':15A,18A '-2026':14A,17A '/osclass/model/item.php':93C '8.3.1':32B,77C 'affect':78C 'argument':38B,104C 'attack':9A,52B,110C,129C 'avail':120C 'caus':106C 'chang':56B 'classifi':20B 'compon':96C 'contact':133C 'could':125C 'craft':44B 'cve':13A,16A 'data':57B 'databas':12A,62B 'disclosur':137C 'earli':134C 'exist':67B 'exploit':66B,116C 'fail':33B 'file':89C 'finduseritem':41B,86C 'function':84C 'handler':99C 'host':27B 'identifi':72C 'includ':92C 'initi':113C 'inject':3A,108C 'item':5A,40B,85C,97C 'let':7A 'made':119C 'manipul':101C 'may':111C 'model':98C 'mysql':21B 'oc':91C 'oc-includ':90C 'osclass':1A,19A,22B,29B,74C 'packag':23B 'php':24B 'public':65B,123C 'read':10A,54B 'remot':8A,51B,114C 'respond':141C 'run':47B 'sanit':35B 'search':6A 'self':26B 'self-host':25B 'site':60B 'spattern':37B,105C 'sql':2A,49B,107C 'unauthent':28B 'use':127C 'valu':45B 'vendor':131C 'vulner':81C 'way':144C 'weak':69C","nicknames":[],"mitigations":[],"who_affected":"Any internet-facing Osclass (including the OsclassPoint fork and Epsilon theme) at 8.3.1 or earlier. The public user-profile page ('user's other listings') passes sPattern to the query unescaped and needs no login, so any visitor can send the injection. Sites on 8.4.0 or later, or with that page's sPattern/sOrder parameters filtered upstream, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T10:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113381","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113381","severity":null,"published_at":"2026-10-20T10:17:05+00:00","modified_at":"2026-10-20T19:27:34+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113381:747","url":null,"severity":null,"published_at":"2026-10-25T03:35:01+00:00","modified_at":"2026-10-25T03:35:01+00:00","first_seen_at":"2026-10-25T03:35:01+00:00","fetched_at":"2026-10-25T03:35:01+00:00","note":"Reporter's forum post (Sep 28) shows unauthenticated SQLi via sPattern on the public /user/profile/ page (user-non-secure.php -> Item::findUserItems, no escapeStr); maintainer replied 'fixed in 8.4'; 8.4.0 released 2 Oct 2026. I did not see the fix itself in the changelog text I read, so the fix is likely, not confirmed. VulDB says the vendor never responded to its disclosure. Same forum post also reports a second unauthenticated blind SQLi via sOrder and a stored XSS (not in this CVE). No vendor advisory exists. Nothing marked verified."}],"documents":[{"id":3232,"url":"https://forums.osclasspoint.com/report-bug/2-unauthenticated-sql-injection-1-stored-xss-in-osclass-8-3-1-core/","title":"Osclass forum: unauthenticated SQLi via sPattern/sOrder in 8.3.1 (maintainer: fixed in 8.4)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":3234,"url":"https://osclass-classifieds.com/changelog","title":"Osclass changelog (8.4.0, 2 Oct 2026)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":3236,"url":"https://vuldb.com/vuln/422654","title":"VulDB 422654: Osclass findUserItems sPattern SQLi","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}