This vulnerability in osCommerce 4.14.63493 involves an SQL injection in the EmailController function of app/lib/backend/controllers/EmailController.php. An attacker can manipulate the email_templates_key parameter to execute arbitrary SQL commands remotely. The vendor was notified but has not issued any response or fix. The CVSS 4.0 base score is 5.1, indicating medium severity with network attack vector, low complexity, and no user interaction required.

Successful exploitation allows remote attackers to perform SQL injection attacks, potentially leading to unauthorized data access or modification within the affected osCommerce installation. The presence of public exploit code increases the risk of exploitation. However, the impact is rated medium due to limited privileges required and low confidentiality, integrity, and availability impacts as per the CVSS vector.

No official patch or remediation has been provided by the vendor. Users should monitor vendor advisories for updates. Until a fix is available, consider restricting access to the vulnerable Email Template Configuration functionality or applying web application firewall rules to detect and block SQL injection attempts targeting the email_templates_key parameter.