CVE-2004-2021

The CVE-2004-2021 issue concerns osCommerce 2.2 and its File Manager (file_manager.php). Multiple connected sources (OpenVAS NASLs and PT-Security) describe a directory traversal vulnerability that lets an attacker include a .. in the filename parameter to read arbitrary files on the web server, ...

CVE-2004-2021

Directory traversal vulnerability in filemanager.php in osCommerce 2.2 allows remote attackers to view arbitrary files via a .. dot dot in the filename argument...

CVE-2004-2021: Undefined Security Weakness

Directory traversal vulnerability in filemanager.php in osCommerce 2.2 allows remote attackers to view arbitrary files via a .. dot dot in the filename argument...

CVE-2005-0458

Cross-site scripting XSS vulnerability in contactus.php in osCommerce 2.2-MS2 allows remote attackers to inject arbitrary web script or HTML via the enquiry parameter...

osCommerce2.txt

there is allready a post on this that have filemanager.php?action=download&filename=../../../../../../etc/passwd sometime the action=download doesn't work , so i tried action=read /admin/filemanager.php?action=read&filename=../../../../...

osCommerce File Manager Directory Traversal Vulnerability

there is allready a post on this that have filemanager.php?action=download&filename=../../../../../../etc/passwd sometime the action=download doesn't work , so i tried action=read /admin/filemanager.php?action=read&filename=../../../../...

osCommerce file_manager.php filename Parameter Traversal Arbitrary File Access

The remote host is running osCommerce, a widely installed open source shopping e-commerce solution. The remote version of this software is vulnerable to a directory traversal flaw which may be exploited by an attacker to read arbitrary files on the remote server with the privileges of the web...

osCommerceXSS.txt

Hello All, I have discovered XSS vulnerability in: osCommerce 2.2-MS2 Authors Site: http://www.oscommerce.com/ +-Example:--------------------------------------------------+ XSS: http://www.victimsite.com/contactus.php?&name=1&email=1&enquiry=%3C/textare a%3E%3Cscript%3Ealert'w00t';%3C/script%3E...

CVE-2005-0458

Cross-site scripting XSS vulnerability in contactus.php in osCommerce 2.2-MS2 allows remote attackers to inject arbitrary web script or HTML via the enquiry parameter...

CVE-2005-0458

CVE-2005-0458 describes a cross-site scripting (XSS) vulnerability in osCommerce 2.2-MS2, specifically in the contact_us.php script where the enquiry parameter can be abused to inject arbitrary script or HTML. The NVD entry confirms the vulnerability as an XSS flaw with the affected component bei...

CVE-2005-0458: Undefined Security Weakness

Cross-site scripting XSS vulnerability in contactus.php in osCommerce 2.2-MS2 allows remote attackers to inject arbitrary web script or HTML via the enquiry parameter...

[NOBYTES.COM: #3] osCommerce 2.2-MS2 - XSS Vulnerability

Hello All, I have discovered XSS vulnerability in: osCommerce 2.2-MS2 Authors Site: http://www.oscommerce.com/ +-Example:--------------------------------------------------+ XSS: http://www.victimsite.com/contactus.php?&name=1&email=1&enquiry=3C/textare a3E3Cscript3Ealert'w00t';3C/script3E Result:...

osCommerce contact_us.php enquiry Parameter XSS

The installed version of OSCommerce is vulnerable to a cross-site scripting XSS attack. An attacker, exploiting this flaw, would need to be able to coerce an unsuspecting user into visiting a malicious website. Upon successful exploitation, the attacker would potentially be able to steal...

osCommerce 2.2 - Contact_us.php Cross-Site Scripting

osCommerce 2.2 - Contactus.php Cross-Site Scripting source: https://www.securityfocus.com/bid/12568/info A vulnerability is reported to exist in osCommerce that may allow a remote user to launch cross-site scripting attacks. This issue could permit a remote attacker to create a malicious URI link...

osCommerce 2.2 - 'Contact_us.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/12568/info A vulnerability is reported to exist in osCommerce that may allow a remote user to launch cross-site scripting attacks. This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this...

CVE-2004-2638

The Admin Access With Levels plugin in osCommerce 1.5.1 allows remote attackers to access files in the "admin/" directory by modifying the inlogin parameter to a non-zero value...

CVE-2004-2021

Directory traversal vulnerability in filemanager.php in osCommerce 2.2 allows remote attackers to view arbitrary files via a .. dot dot in the filename argument...

PT-2004-2917 · Oscommerce · Oscommerce

Name of the Vulnerable Software and Affected Versions: osCommerce version 2.2 Description: A directory traversal issue exists, allowing remote attackers to view arbitrary files by including a .. dot dot in the filename argument of the file manager.php script. Recommendations: For osCommerce versi...

osCommerce Admin Interface Detection

Binary data 2507.prm...

advisory13.txt

l0om - l0omatexcluded.org - www.excluded.org greets, while i was "warsearching" with google i suddenly have been on the admin interfaces of many oscommerce sites. i made a: allinurl:admin/filemanager.php for nomal you can only view your oscommerce directorys, but if you type in the following you...