CVE-2026-105225: osCommerce RCE Vulnerability via Payment

CVE-2026-105225 Overview

CVE-2026-105225 is a code injection vulnerability [CWE-74] affecting osCommerce osCommerce2 up to version 2.3.4.1. The flaw resides in the include function call within includes/classes/payment.php, part of the Payment Page component. Attackers can manipulate the MODULE_PAYMENT_INSTALLED argument to inject code that the application subsequently executes. The attack is remotely reachable but requires high privileges to exploit, limiting its practical impact. A public exploit disclosure exists, and the osCommerce project had not responded to the issue report at the time of CVE assignment.

Critical Impact
Authenticated attackers with high privileges can inject code into the osCommerce payment subsystem over the network, resulting in low-impact compromise of confidentiality, integrity, and availability on the affected store.

Affected Products

osCommerce osCommerce2 versions up to and including 2.3.4.1
The vulnerable component is the Payment Page (includes/classes/payment.php)
Deployments exposing the administrative payment configuration interface are in scope

Discovery Timeline

2026-10-05 - CVE-2026-105225 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105225

Vulnerability Analysis

The weakness is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The osCommerce payment class loads installed payment modules dynamically by referencing the MODULE_PAYMENT_INSTALLED configuration value. When this value is not properly validated or neutralized, an attacker able to modify it can influence what PHP code the include statement loads at runtime. Because MODULE_PAYMENT_INSTALLED is managed through an authenticated administrative context, exploitation requires an attacker to already hold high privileges within the store. The user interaction requirement further narrows the practical attack path, and the resulting impact on confidentiality, integrity, and availability is scoped as low per the CVSS 4.0 vector.

Root Cause

The root cause is unsafe handling of the MODULE_PAYMENT_INSTALLED configuration argument that feeds into a PHP include operation. osCommerce treats the stored value as trusted and does not strictly constrain it to an allow-list of known module filenames. Any attacker-controlled content that reaches the include call becomes executable code, which is the defining pattern of PHP file inclusion and code injection flaws.

Attack Vector

Exploitation occurs over the network against the Payment Page component. The attacker must authenticate with elevated privileges and perform a user-driven action that persists a malicious MODULE_PAYMENT_INSTALLED value. On the next request that instantiates the payment class, the manipulated value is passed to include, and the injected payload is executed in the context of the PHP worker. A public exploit disclosure accompanies this CVE, which lowers the barrier for opportunistic use against unpatched installations.

No verified exploit code is published in this advisory. Technical details are tracked in the GitHub Issue #677 and VulDB entry for CVE-2026-105225.

Detection Methods for CVE-2026-105225

Indicators of Compromise

Unexpected modifications to the MODULE_PAYMENT_INSTALLED configuration entry in the osCommerce configuration table
PHP include or require warnings in web server logs referencing paths derived from includes/classes/payment.php
New or unknown files appearing under includes/modules/payment/ without a corresponding administrator change record
Outbound network connections or child processes spawned by the PHP worker shortly after payment page requests

Detection Strategies

Baseline the MODULE_PAYMENT_INSTALLED value and alert on any administrative change to it
Hunt for web access log entries that modify payment module configuration endpoints followed by catalog payment page hits
Review PHP error logs for include-related warnings that reference non-standard filenames or path traversal sequences

Monitoring Recommendations

Enable file integrity monitoring on includes/classes/payment.php and includes/modules/payment/
Forward web server, PHP, and database audit logs to a centralized analytics tier for correlation
Monitor administrator session activity for anomalous changes to payment module settings outside maintenance windows

How to Mitigate CVE-2026-105225

Immediate Actions Required

Restrict access to the osCommerce administrative interface to trusted networks and enforce strong authentication for all administrators
Audit the current value of MODULE_PAYMENT_INSTALLED and reset it to a known-good list of expected module filenames
Review recent administrator activity for unauthorized changes to payment module configuration
Rotate administrator credentials and session tokens if tampering is suspected

Patch Information

At the time of publication, the osCommerce project had not released a vendor fix for CVE-2026-105225 and had not responded to the public issue report. Track the osCommerce repository and GitHub Issue #677 for upstream patch availability. Operators should plan to apply the vendor patch as soon as it becomes available and validate it against the exploit disclosure referenced in VulDB #413427.

Workarounds

Place the osCommerce administration directory behind an additional authentication layer such as HTTP basic auth or an IP allow-list
Add server-side validation that constrains MODULE_PAYMENT_INSTALLED to a strict allow-list of known payment module filenames
Set the PHP open_basedir directive to limit file inclusion to the osCommerce installation path
Deploy a web application firewall rule that blocks requests attempting to write unexpected characters into payment module configuration parameters

bash

# Configuration example: restrict administrative access at the web server level
# Example nginx snippet (adapt paths and allow-list to your environment)
location /admin/ {
    allow 10.0.0.0/24;
    deny all;
    auth_basic "osCommerce Admin";
    auth_basic_user_file /etc/nginx/.htpasswd;
}