osCommerce - Arbitrary File Upload File Disclosure

osCommerce - Arbitrary File Upload File Disclosure source: https://www.securityfocus.com/bid/50301/info osCommerce is prone to a remote file upload and a file disclosure vulnerability. The issues occur because the application fails to adequately sanitize user-supplied input. An attacker can explo...

osCommerce - Arbitrary File Upload / File Disclosure

source: https://www.securityfocus.com/bid/50301/info osCommerce is prone to a remote file upload and a file disclosure vulnerability. The issues occur because the application fails to adequately sanitize user-supplied input. An attacker can exploit these issues to upload a file and obtain an...

Free Way osCommerce Shell Upload / File Disclosure

======================================================== Free Way osCommerce Remote File Upload / File Disclosure ======================================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=0 0 1 1 | | | | | | | | | | | | \ \ / / 0 0 | | | | | | / / | | | || | ...

CVE-2011-3767

osCommerce 3.0a5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by redirect.php...

Information disclosure

osCommerce 3.0a5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by redirect.php...

CVE-2011-3767: Exposure of Sensitive Information to an Unauthorized Actor

osCommerce 3.0a5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by redirect.php...

CVE-2011-3767

osCommerce 3.0a5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by redirect.php...

PT-2011-4657

Name of the Vulnerable Software and Affected Versions osCommerce version 3.0a5 Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is demonstrated by accessing the 'redirect.php' file, which reveals the installation path in an...

CVE-2011-3767

osCommerce 3.0a5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by redirect.php...

CVE-2011-3767

The CVE-2011-3767 issue affects osCommerce 3.0a5 and allows a remote attacker to obtain sensitive information by directly requesting a .php file (demonstrated via redirect.php). The vulnerability causes an error message that reveals the installation path. Exploit details, affected versions beyond...

oscommerce online merchant v2.2 rc2 - [CSRF] Change admin and pass

Exploit for php platform in category web applications Exploit Title: oscommerce online merchant v2.2 rc2 - CSRF Change name admin and pass Author: Dmar al3noOoz Mail : email protected Name : oscommerce online merchant v2.2 rc2 dork : Google Dork: "oscommerce online merchant v2.2 rc2" Software Lin...

osCommerce infected with malware

This installation of OsCommerce is infected with malware. OpenVAS Vulnerability Test $Id: gboscommercemalware.nasl 7170 2017-09-18 10:35:33Z cfischer $ osCommerce infected with malware Authors: Michael Meyer Copyright: Copyright c 2011 Greenbone Networks GmbH This program is free software; you ca...

osCommerce infected with malware

This installation of OsCommerce is infected with malware. Copyright C 2011 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you...

Massive Injection Campaign Affecting More Than Six Million Pages

We recently reported on a massive drive-by-download campaign affecting some 90,000 Web pages. In the less than two weeks since that report, the same campaign is now affecting more than six million pages. The obvious question is: why has there been such an aggressive increase in the number of...

osCommerce v2.3.x - Multiple Cross Site Vulnerabilities

Document Title: =============== osCommerce v2.3.x - Multiple Cross Site Vulnerabilities Release Date: ============= 2011-07-31 Vulnerability Laboratory ID VL-ID: ==================================== 241 Product & Service Introduction: =============================== osCommerce has attracted a lar...

osCommerce v2.3.x - Multiple Cross Site Vulnerabilities

Document Title: =============== osCommerce v2.3.x - Multiple Cross Site Vulnerabilities Release Date: ============= 2011-07-31 Vulnerability Laboratory ID VL-ID: ==================================== 241 Product & Service Introduction: =============================== osCommerce has attracted a lar...

eClime eCommerce JE 1.0.6b - SQL Injection Vulnerabilities

Document Title: =============== eClime eCommerce JE 1.0.6b - SQL Injection Vulnerabilities Release Date: ============= 2011-07-13 Vulnerability Laboratory ID VL-ID: ==================================== 82 Product & Service Introduction: =============================== eclime is a very powerful...

eClime eCommerce JE 1.0.6b - SQL Injection Vulnerabilities

Document Title: =============== eClime eCommerce JE 1.0.6b - SQL Injection Vulnerabilities Release Date: ============= 2011-07-13 Vulnerability Laboratory ID VL-ID: ==================================== 82 Product & Service Introduction: =============================== eclime is a very powerful...

osCommerce Remote Edit Site Info Vulnerability

Exploit for php platform in category web applications Exploit Title:osCommerce Remote Edit Site Info Vulnerability Date: 10/7/2011 Author: Angel Injection home Page: http://www.club-h.co.cc Email: Angel-InjectionathotmailDotcom Vendor or Software Link: www.oscommerce.com Version: N/A Category::...

Dangerous Whitespaces

By Marta Janus A few days ago, I blogged about a PHP/JS malware targeting the osCommerce platform, which used an interesting new technique to obfuscate the malicious code. It so happens, that today I came across even more advanced sample of a PHP infector, also in the context of a vulnerable...