File Disclosure in osCommerce

There is a vulnerability in the osCommerce's File Manager that allows an attacker to retrieve arbitrary files from the webserver that reside outside the bounding HTML root directory. OpenVAS Vulnerability Test $Id: oscommercefilemanagerdisclosure.nasl 6053 2017-05-01 09:02:51Z teissa $ Descriptio...

osCommerce directory traversal

The remote host is running osCommerce, a widely installed open source shopping e-commerce solution. The remote version of this software is vulnerable to a directory traversal flaw which may be exploited by an attacker to read arbitrary files on the remote server with the privileges of the web...

CVE-2003-1219

CVE-2003-1219 affects osCommerce prior to version 2.2-MS3. The vulnerability is a cross-site scripting (XSS) flaw in the tep_href_link function in html_output.php that can be triggered by manipulating the osCsid parameter, enabling remote attackers to inject arbitrary scripts or HTML. Connected s...

CVE-2003-1219

Cross-site scripting XSS vulnerability in the tephreflink function in htmloutput.php for osCommerce before 2.2-MS3 allows remote attackers to inject arbitrary web script or HTML via the osCsid parameter...

CVE-2003-1219: Undefined Security Weakness

Cross-site scripting XSS vulnerability in the tephreflink function in htmloutput.php for osCommerce before 2.2-MS3 allows remote attackers to inject arbitrary web script or HTML via the osCsid parameter...

osCommerce update.php readme_file Parameter Arbitrary File Disclosure

The osCommerce installation on the remote host has a supplementary script, 'extras/update.php', that fails to validate user-supplied input to the 'readmefile' parameter before using that to display a file. An attacker can exploit this flaw to read arbitrary files on the remote host, such as the...

osCommerce Unprotected Admin Directory

The installation of osCommerce on the remote host apparently lets anyone access the application's admin directory, which means that they have complete administrative access to the site. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

CVE-2005-2330

Directory traversal vulnerability in extras/update.php in osCommerce 2.2 allows remote attackers to read arbitrary files via 1 .. sequences or 2 a full pathname in the readmefile parameter...

CVE-2005-2330

CVE-2005-2330 describes a directory-traversal flaw in osCommerce 2.2, specifically in the extras/update.php script. A remote attacker can exploit the readme_file parameter by using ".." sequences or a full pathname to read arbitrary files on the server. Impact is described as the ability to acces...

EUVD-2005-2331

Directory traversal vulnerability in extras/update.php in osCommerce 2.2 allows remote attackers to read arbitrary files via 1 .. sequences or 2 a full pathname in the readmefile parameter...

CVE-2005-2330

Directory traversal vulnerability in extras/update.php in osCommerce 2.2 allows remote attackers to read arbitrary files via 1 .. sequences or 2 a full pathname in the readmefile parameter...

CVE-2005-2330: Undefined Security Weakness

Directory traversal vulnerability in extras/update.php in osCommerce 2.2 allows remote attackers to read arbitrary files via 1 .. sequences or 2 a full pathname in the readmefile parameter...

osCommerce 2.2 - update.php Information Disclosure

osCommerce 2.2 - update.php Information Disclosure source: https://www.securityfocus.com/bid/14294/info osCommerce is prone to an information-disclosure vulnerability. An attacker could exploit this vulnerability to display the contents of any file normally readable by the webserver process...

osCommerce 2.2 - 'update.php' Information Disclosure

source: https://www.securityfocus.com/bid/14294/info osCommerce is prone to an information-disclosure vulnerability. An attacker could exploit this vulnerability to display the contents of any file normally readable by the webserver process. Successful exploitation would result in information...

CVE-2002-2019

PHP remote file inclusion vulnerability in includeonce.php in osCommerce a.k.a. Exchange Project 2.1 allows remote attackers to execute arbitrary PHP code via the includefile parameter...

CVE-2002-1991

The CVE-2002-1991 entry describes a PHP file inclusion vulnerability in osCommerce 2.1, exploitable via the include_file parameter to include_once.php to execute arbitrary commands. Affected component: include_once.php in osCommerce 2.1. Impact is indicated as partial confidentiality/integrity/av...

CVE-2002-2019

CVE-2002-2019 refers to a PHP remote file inclusion vulnerability in the include_once.php file of osCommerce (Exchange Project) 2.1. The issue allows a remote attacker to execute arbitrary PHP code by supplying a crafted value to the include_file parameter. The affected software is osCommerce 2.1...

CVE-2002-1991

PHP file inclusion vulnerability in osCommerce 2.1 execute arbitrary commands via the includefile parameter to includeonce.php...

CVE-2002-2019: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in includeonce.php in osCommerce a.k.a. Exchange Project 2.1 allows remote attackers to execute arbitrary PHP code via the includefile parameter...

CVE-2002-1991: Improper Control of Generation of Code

PHP file inclusion vulnerability in osCommerce 2.1 execute arbitrary commands via the includefile parameter to includeonce.php...