# Security Bulletin 2009-004

**URL:** <https://forum.oxid-esales.com/t/security-bulletin-2009-004/39602>\
**Category:** OXID Announcements\
**Tags:** security\
**Created:** [October 15, 2009, 8:48am UTC](https://forum.oxid-esales.com/t/security-bulletin-2009-004/39602 "2009-10-15T08:48:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![stefanwerner](https://forum.oxid-esales.com/letter_avatar_proxy/v4/letter/s/58956e/32.png) [@stefanwerner](https://forum.oxid-esales.com/u/stefanwerner)\
**Post date:** [October 15, 2009, 8:48am UTC](https://forum.oxid-esales.com/t/security-bulletin-2009-004/39602/1 "2009-10-15T08:48:37Z")

</div>

Hi everybody,

as part of a regular audit, a security issue has been identified: Specially crafted SQL statements can lead to unauthorized access to the database.

All OXID eShops of versions 2.7.x, 3.x and 4.x are affected, no exploits are known yet.

For version 4.x of the OXID eShop this security issue has been fixed with version 4.1.6, please find the appropriate patch here:

> **[OXID eShop version 4.1.6 • OXIDforge](https://oxidforge.org/en/oxid-eshop-version-4-1-6.html)**
>
> General hints for this package The issue #0001272 was resolved by using ‘&lang=’ instead of ‘&lang=’ to prevent broken characters. Please check content edited with WYSIWYG editor in eShop admin (article long descriptions, categories long...

The Security Bulletin 2009-004 was published at  
[http://www.oxidforge.org/wiki/Security\_bulletins/2009-004](http://www.oxidforge.org/wiki/Security_bulletins/2009-004).

Clients of versions 2.7.0.3 and 3.0.4.1 with a support contract will shortly be sent a patch that fixes the security issue. Unfortunately, older versions can not be supported.

Regards

---

<div class="post-metadata">

**Author:** ![gggbb](https://forum.oxid-esales.com/letter_avatar_proxy/v4/letter/g/ed655f/32.png) [@gggbb](https://forum.oxid-esales.com/u/gggbb)\
**Post date:** [October 21, 2009, 1:59pm UTC](https://forum.oxid-esales.com/t/security-bulletin-2009-004/39602/2 "2009-10-21T13:59:48Z")

</div>

[QUOTE=Stefan Werner;16141]

Clients of versions 2.7.0.3 and 3.0.4.1 with a support contract will shortly be sent a patch that fixes the security issue. Unfortunately, older versions can not be supported.

[/QUOTE]

Is it possible to get the patch without a support contract? How much would that be?

Regards

---

<div class="post-metadata">

**Author:** ![marco.steinhaeuser](https://forum.oxid-esales.com/user_avatar/forum.oxid-esales.com/marco.steinhaeuser/32/1832_2.png) [@marco.steinhaeuser](https://forum.oxid-esales.com/u/marco.steinhaeuser)\
**Post date:** [October 22, 2009, 11:18am UTC](https://forum.oxid-esales.com/t/security-bulletin-2009-004/39602/3 "2009-10-22T11:18:33Z")

</div>

Hi gggbb,

no, unfortunately not.  
You may want to turn to our sales department where a solution shall be found.

Regards

---

<div class="post-metadata">

**Author:** ![system](https://forum.oxid-esales.com/user_avatar/forum.oxid-esales.com/system/32/4245_2.png) [@system](https://forum.oxid-esales.com/u/system)\
**Post date:** [July 13, 2026, 8:35pm UTC](https://forum.oxid-esales.com/t/security-bulletin-2009-004/39602/4 "2026-07-13T20:35:32Z")

</div>