---
id: "CVE-2026-113381"
kind: "vulnerability"
aliases: ["CVE-2026-113381"]
title: "Osclass: SQL injection in item search lets remote attackers read the database"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "osclass", "fixed": ["8.4.0"], "affected": "<= 8.3.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["classifieds", "mysql", "osclass", "package", "php", "self-hosted", "unauthenticated"]
not_affected_if: ["newer-version", "osclass-8.4.0-or-later", "spattern-filtered-at-waf"]
published_at: "2026-10-20T10:17:05+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T03:35:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113381", "first_seen_at": "2026-10-23T21:57:20+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:35:01+00:00"}]
---

# Osclass: SQL injection in item search lets remote attackers read the database

Osclass up to 8.3.1 fails to sanitize the sPattern argument in Item::findUserItems, so a crafted value is run as SQL. A remote attacker can read or change data in the site's database, and a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:osclass affected <= 8.3.1 fixed 8.4.0

## How to check

- Check the Osclass version (admin dashboard, or OSCLASS_VERSION in oc-includes/osclass/default-constants.php or similar); 8.3.1 and earlier are affected, and the forum reporter says 8.3.0 is too.
- In oc-includes/osclass/model/Item.php, findUserItems(): if $pattern is put into the MATCH(...) AGAINST('%s') or like '%%%s%%' sprintf calls without $this->dao->escapeStr(), the site is vulnerable.
- Look in web logs for requests to /user/profile/ (or page=user&action=pub_profile) with sPattern containing quotes, UNION, SLEEP or --.

## Fix

Upgrade to Osclass 8.4.0 (released 2 Oct 2026; maintainer said the sPattern bug would be fixed in 8.4, the changelog I read does not confirm it). Until then, block or sanitize the sPattern and sOrder query parameters on /user/profile/ at the web server or WAF.

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113381
- 2026-10-25T03:35:01+00:00 analyst — Reporter's forum post (Sep 28) shows unauthenticated SQLi via sPattern on the public /user/profile/ page (user-non-secure.php -> Item::findUserItems, no escapeStr); maintainer replied 'fixed in 8.4'; 8.4.0 released 2 Oct 2026. I did not see the fix itself in the changelog text I read, so the fix is likely, not confirmed. VulDB says the vendor never responded to its disclosure. Same forum post also reports a second unauthenticated blind SQLi via sOrder and a stored XSS (not in this CVE). No vendor advisory exists. Nothing marked verified.

## Documents

- [advisory] VulDB 422654: Osclass findUserItems sPattern SQLi https://vuldb.com/vuln/422654
- [describes] Osclass forum: unauthenticated SQLi via sPattern/sOrder in 8.3.1 (maintainer: fixed in 8.4) https://forums.osclasspoint.com/report-bug/2-unauthenticated-sql-injection-1-stored-xss-in-osclass-8-3-1-core/
- [fix] Osclass changelog (8.4.0, 2 Oct 2026) https://osclass-classifieds.com/changelog

## From the sources

A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the component Item Model Handler. This manipulation of the argument sPattern causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_