Information disclosure

osCommerce 3.0a5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by redirect.php...

CVE-2011-3767

The CVE-2011-3767 issue affects osCommerce 3.0a5 and allows a remote attacker to obtain sensitive information by directly requesting a .php file (demonstrated via redirect.php). The vulnerability causes an error message that reveals the installation path. Exploit details, affected versions beyond...

osCommerce Local File Include and HTML Injection Vulnerabilities

osCommerce is prone to a local file-include vulnerability and an HTML- injection vulnerability because it fails to properly sanitize user- supplied input. An attacker can exploit the local file-include vulnerability using directory- traversal strings to execute local files within the context of t...