CVE-2026-113381: Osclass Item Model Item.php findUserItems sql injection
A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the component Item Model Handler. This manipulation of the argument sPattern causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Osclass installations up to version 8.3.1 are affected. The vulnerable code is Item::findUserItems in oc-includes/osclass/model/Item.php.
Does exploitation require authentication or user interaction?
No. The vulnerability is remotely exploitable and is rated as requiring no privileges and no user interaction.
What input is involved in the attack?
The SQL injection is caused by manipulation of the sPattern argument passed to Item::findUserItems.
Is public exploit information available?
Yes. An exploit has been made publicly available and could be used in attacks.
Is a vendor fix or response confirmed?
No vendor response is reported. The vendor was contacted early about the disclosure but did not respond.