[NOBYTES.COM: #3] osCommerce 2.2-MS2 - XSS Vulnerability

Hello All, I have discovered XSS vulnerability in: osCommerce 2.2-MS2 Authors Site: http://www.oscommerce.com/ +-Example:--------------------------------------------------+ XSS: http://www.victimsite.com/contactus.php?&name=1&email=1&enquiry=3C/textare a3E3Cscript3Ealert'w00t';3C/script3E Result:...

osCommerce contact_us.php enquiry Parameter XSS

The installed version of OSCommerce is vulnerable to a cross-site scripting XSS attack. An attacker, exploiting this flaw, would need to be able to coerce an unsuspecting user into visiting a malicious website. Upon successful exploitation, the attacker would potentially be able to steal...

osCommerce 2.2 - Contact_us.php Cross-Site Scripting

osCommerce 2.2 - Contactus.php Cross-Site Scripting source: https://www.securityfocus.com/bid/12568/info A vulnerability is reported to exist in osCommerce that may allow a remote user to launch cross-site scripting attacks. This issue could permit a remote attacker to create a malicious URI link...

osCommerce 2.2 - 'Contact_us.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/12568/info A vulnerability is reported to exist in osCommerce that may allow a remote user to launch cross-site scripting attacks. This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this...

CVE-2004-2638

The Admin Access With Levels plugin in osCommerce 1.5.1 allows remote attackers to access files in the "admin/" directory by modifying the inlogin parameter to a non-zero value...

CVE-2004-2021

Directory traversal vulnerability in filemanager.php in osCommerce 2.2 allows remote attackers to view arbitrary files via a .. dot dot in the filename argument...

PT-2004-2917 · Oscommerce · Oscommerce

Name of the Vulnerable Software and Affected Versions: osCommerce version 2.2 Description: A directory traversal issue exists, allowing remote attackers to view arbitrary files by including a .. dot dot in the filename argument of the file manager.php script. Recommendations: For osCommerce versi...

osCommerce Admin Interface Detection

Binary data 2507.prm...

advisory13.txt

l0om - l0omatexcluded.org - www.excluded.org greets, while i was "warsearching" with google i suddenly have been on the admin interfaces of many oscommerce sites. i made a: allinurl:admin/filemanager.php for nomal you can only view your oscommerce directorys, but if you type in the following you...

oscommerce 2.2 file_manager.php file browsing

l0om - l0omatexcluded.org - www.excluded.org greets, while i was "warsearching" with google i suddenly have been on the admin interfaces of many oscommerce sites. i made a: allinurl:admin/filemanager.php for nomal you can only view your oscommerce directorys, but if you type in the following you...

osCommerce 2.x - File Manager Directory Traversal

source: https://www.securityfocus.com/bid/10364/info osCommerce has a directory-traversal vulnerability that allows a remote attacker to possibly obtain sensitive information. The software improperly sanitizes user-supplied input and allows '../' directory-traversal character sequences when servi...

CVE-2003-1219

Cross-site scripting XSS vulnerability in the tephreflink function in htmloutput.php for osCommerce before 2.2-MS3 allows remote attackers to inject arbitrary web script or HTML via the osCsid parameter...

osCommerce SQL Injection && DoS && Cross Site Scripting

Vendor : osCommerce URL : http://www.oscommerce.com Version : osCommerce 2.2-MS1 / osCommerce 2.2-MS2 Risk : SQL Injection Vulnerability & XSS in MS1 And Denial Of Service to users in MS1 & MS2 Description: osCommerce is an online shop e-commerce solution under on going development by the open...

osCommerce 2.2 - manufacturers_id Cross-Site Scripting

osCommerce 2.2 - manufacturersid Cross-Site Scripting source: https://www.securityfocus.com/bid/9277/info A vulnerability has been reported to exist in the software that may allow a remote user to launch cross-site scripting attacks. The problem is reported to exist due to improper sanitizing of...

osCommerce 2.2 - products_id SQL Injection

osCommerce 2.2 - productsid SQL Injection source: https://www.securityfocus.com/bid/9275/info It has been reported that one of the scripts included with osCommerce fails to validate user-supplied input, rendering it vulnerable to a SQL injection attack. It has been reported that an attacker may...

osCommerce 2.2 - 'manufacturers_id' Cross-Site Scripting

source: https://www.securityfocus.com/bid/9277/info A vulnerability has been reported to exist in the software that may allow a remote user to launch cross-site scripting attacks. The problem is reported to exist due to improper sanitizing of user-supplied data in certain URI parameters passed to...

osCommerce < 2.2-MS2 - Multiple Vulnerabilities

Source: http://gulftech.org/advisories/osCommerce%20Multiple%20Vulnerabilities/19 osCommerce Multiple Vulnerabilities Vendor: osCommerce Product: osCommerce Version: = 2.2-MS2 Website: http://www.oscommerce.com BID: 9275 9277 Description: osCommerce is an online shop e-commerce solution under on...

osCommerce 2.2-MS2 - Multiple Vulnerabilities

osCommerce 2.2-MS2 - Multiple Vulnerabilities Source: http://gulftech.org/advisories/osCommerce%20Multiple%20Vulnerabilities/19 osCommerce Multiple Vulnerabilities Vendor: osCommerce Product: osCommerce Version: = 2.2-MS2 Website: http://www.oscommerce.com BID: 9275 9277 Description: osCommerce i...

osCommerce 2.2 - 'products_id' SQL Injection

source: https://www.securityfocus.com/bid/9275/info It has been reported that one of the scripts included with osCommerce fails to validate user-supplied input, rendering it vulnerable to a SQL injection attack. It has been reported that an attacker may supply malicious SQL queries as a URI...

osCommerce Malformed Session ID XSS Vuln

Vendor : osCommerce URL : http://www.oscommerce.com Version : All Current Versions Risk : Cross Site Scripting Description: osCommerce is an online shop e-commerce solution under on going development by the open source community. Its feature packed out-of-the-box installation allows store owners ...