OSClass vulnerabilities

A weakness has been identified in Osclass up to 8.3.1. Affected is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the Item Model Handler component. Manipulation of the sPattern argument causes SQL injection. The attack may be initiated remotely and the exploit has been made public. The vendor was contacted early but did not respond.

CVE-2014-8084 in OSClass before version 3.4.3 has a directory traversal vulnerability that allows remote attackers to include and execute arbitrary local files.

SQL injection vulnerability in the Search::setJsonAlert method in OSClass before version 3.4.3 allows remote attackers to execute arbitrary SQL commands via the alert parameter in a search alert subscription action.