CVE-2026-105225: Code Injection in osCommerce osCommerce2

This vulnerability in osCommerce osCommerce2 up to versions 2.3.4.1 involves improper handling of the MODULE_PAYMENT_INSTALLED argument in the include function of includes/classes/payment.php. This flaw permits remote code injection, potentially allowing attackers to execute arbitrary code on the affected system. The issue was reported early to the project, but no official fix or response has been provided. Public exploit code exists, increasing the risk of exploitation.

Successful exploitation can lead to remote code execution on the affected system, which may compromise the integrity and confidentiality of the application and underlying server. The CVSS 4.8 score indicates a medium severity with network attack vector, low complexity, and partial impact on confidentiality, integrity, and availability. No known active exploitation in the wild has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch has been released and the vendor has not responded, users should consider applying workarounds such as disabling or restricting the vulnerable functionality if possible, or isolating affected systems until a patch is available. Monitor official osCommerce channels for updates.