osCommerce Error-based SQL Injection Vulnerability

TemplateMonster osCommerce prior to version 2.3x suffers from an error-based SQL injection vulnerability. +---------------------------------------------------------+ | Vulnerable Software: TemplateMonster osCommerce | | Vendor: http://templatemonster.org | | Vulnerability Type: Error-based SQL...

osCommerce 2.3.4 Local File Inclusion / Cross Site Request Forgery

Advisory ID: HTB23284 Product: osCommerce Vendor: osCommerce Vulnerable Versions: 2.3.4 and probably prior Tested Version: 2.3.4 Advisory Publication: December 21, 2015 without technical details Vendor Notification: December 21, 2015 Public Disclosure: February 17, 2016 Vulnerability Type: PHP Fi...

RCE via CSRF in osCommerce

High-Tech Bridge Security Research Lab discovered vulnerability in popular e-commerce software osCommerce with 280,000 store owners according to the vendor. The vulnerability can be exploited to execute arbitrary PHP code on the remote system, compromise the vulnerable web application, its databa...

oscommerce-ssl.com XSS vulnerability

Vulnerable URL: http://oscommerce-ssl.com/en/search.php?txtSearch=replace" Details: Description| Value ---|--- Patched:| Yes, at 25.07.2017 Latest check for patch:| 25.07.2017 17:37 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated Google...

osCommerce Japanese Directory Traversal Vulnerability

osCommerce Japanese is a GNUGPL license based on the Japanese version of the open source online shopping e-commerce solution . A directory traversal vulnerability exists in osCommerce Japanese 2.2ms1j-R8 and earlier versions. A remote attacker can exploit this vulnerability to read arbitrary file...

CVE-2015-2965

Directory traversal vulnerability in osCommerce Japanese 2.2ms1j-R8 and earlier allows remote authenticated administrators to read arbitrary files via unspecified vectors...

Directory traversal

Directory traversal vulnerability in osCommerce Japanese 2.2ms1j-R8 and earlier allows remote authenticated administrators to read arbitrary files via unspecified vectors...

CVE-2015-2965

CVE-2015-2965 affects osCommerce Japanese version 2.2ms1j-R8 and earlier, with a directory traversal vulnerability that allows remote authenticated administrators to read arbitrary files via unspecified vectors. Root cause is not fully detailed in the provided documents, but user impact is clear:...

CVE-2015-2965

Directory traversal vulnerability in osCommerce Japanese 2.2ms1j-R8 and earlier allows remote authenticated administrators to read arbitrary files via unspecified vectors...

PT-2015-6013

Name of the Vulnerable Software and Affected Versions osCommerce Japanese versions 2.2ms1j-R8 and earlier Description The issue allows remote authenticated administrators to read arbitrary files. Recommendations For osCommerce Japanese versions 2.2ms1j-R8 and earlier, at the moment, there is no...

CVE-2015-2965: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in osCommerce Japanese 2.2ms1j-R8 and earlier allows remote authenticated administrators to read arbitrary files via unspecified vectors...

osCommerce Japanese version vulnerable to directory traversal

Overview osCommerce is an open source system for creating shopping websites. osCommerce Japanese version contains a directory traversal vulnerability. Masako Ohno reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership...

JVN#96312698: osCommerce Japanese version vulnerable to directory traversal

osCommerce is an open source system for creating shopping websites. osCommerce Japanese version contains a directory traversal vulnerability. Impact A user who can log in to the system as an administrator may obtain arbitrary files on the server. Solution Update the Software Update to the latest...

OsCommerce Configuration SQL Injection Attempt

An SQL injection vulnerability has been reported in OsCommerce Online Merchant. Successful exploitation of this vulnerability would allow a remote attacker to modify and pull confidential database information...

OsCommerce Mail Cross-Site Scripting Attempt

A cross-site scripting vulnerability has been reported in OsCommerce Online Merchant platform. Successful exploitation of this vulnerability would allow remote attackers to inject web script into the affected system...

OsCommerce Cross-Site Request Forgery Administrator Creation

A Cross-Site Request Forgery vulnerability has been reported in OsCommerce Online Merchant platform. Successful exploitation of this vulnerability would allow remote attackers to create administrator users on the affected system...

OsCommerce Configuration Cross-Site Scripting

A cross-site scripting vulnerability has been reported in OsCommerce Online Merchant platform. Successful exploitation of this vulnerability would allow remote attackers to inject web script into the affected system...

OsCommerce Cross-Site Request Forgery Administrator Deletion

A Cross-Site Request Forgery vulnerability has been reported in OsCommerce Online Merchant platform. Successful exploitation of this vulnerability would allow remote attackers to delete administrator users from the affected system...

osCommerce 2.3.4 - SQL Injection & Stored XSS Vulnerabilities

Exploit for php platform in category web applications Title: osCommerce 2.3.4 - SQL Injection & Stored XSS Date: 13.03.15 Affected versions: = 2.3.4 latest atm Vendor: oscommerce.com Tested on: Apache 2.2 / PHP 5.3 @ linux Contact: smash at devilteam.pl As disclosed before, you may create new...

CVE-2014-10033

SQL injection vulnerability in the updatezone function in catalog/admin/geozones.php in osCommerce Online Merchant 2.3.3.4 and earlier allows remote administrators to execute arbitrary SQL commands via the zID parameter in a list action...