View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0007991 | OXID eShop (all versions) | 2. ----- eShop backend (admin) ----- | public | 2026-07-31 13:58 | 2026-08-10 19:43 |
| Reporter | Stefan_Werner | Assigned To | |||
| Priority | normal | Severity | major | Reproducibility | always |
| Status | feedback | Resolution | open | ||
| Product Version | 7.4.1 | ||||
| Summary | 0007991: SQL Injection via getRequestEscapedParameter() via Admin | ||||
| Description | getRequestEscapedParameter() doesnt escape parameters if its used in admin focus so some functions allow sql injections especially if used in combination with $database = \OxidEsales\Eshop\Core\DatabaseProvider::getDb(); Example: htdocs/vendor/oxid-esales/oxideshop-ee/Application/Controller/Admin/ArticleRightsBuyableAjax.php htdocs/vendor/oxid-esales/oxideshop-ee/Application/Controller/Admin/AttributeCategoryAjax.php and more | ||||
| Additional Information | Many versions, all editions and | ||||
| Tags | No tags attached. | ||||
| Theme | Not defined | ||||
| Browser | Not defined | ||||
| PHP Version | Not defined | ||||
| Database Version | Not defined | ||||
|
|
Thanks for the report. You're right that getRequestEscapedParameter() skips checkParamSpecialChars() in admin context (Core/Request.php:53-56). However, checkParamSpecialChars() only replaces HTML special chars. It was never an SQL escape, not even in frontend context. SQL protection in OXID is handled via $db->quote(), $db->quoteArray() or prepared statements. Both ArticleRightsBuyableAjax.php and AttributeCategoryAjax.php (EE) use $db->quote() / quoteArray() / prepared statements for every SQL insertion of the parameter values. No unquoted concatenation found. Please provide a concrete PoC: file path, line number, resulting SQL string, payload, and OXID version/edition. Otherwise we'll have to close as not reproducible. AF |
