CVE-2018-14481: Improper Neutralization of Input During Web Page Generation

Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280...

OSclass 3.7.4 Cross Site Scripting

Multiple Cross-site Scripting Vulnerabilities in OSclass 3.7.4 Information -------------------- Advisory by Netsparker Name: Multiple Cross-site Scripting Vulnerabilities in OSclass 3.7.4 Affected Software: OSclass Affected Versions: 3.7.4 Homepage: https://osclass.org/ Vulnerability: Reflected...

osClass 3.6.1: Remote Code Execution via Image File

RIPS Analysis RIPS was able to scan the 156,000 lines of code in just 23 seconds. Looking at the scan results, a high number of vulnerabilities were detected in this project. Especially high-rated vulnerabilities seem to make the race. However, there is no critical-rated vulnerability found on th...

Osclass 3.5.9 SQL Injection

Advisory ID: HTB23287 Product: Osclass Vendor: https://osclass.org/ Vulnerable Versions: 3.5.9 and probably prior Tested Version: 3.5.9 Advisory Publication: December 21, 2015 without technical details Vendor Notification: December 21, 2015 Vendor Patch: January 25, 2016 Public Disclosure: Februa...

Osclass SQL Injection Vulnerability

OSClass is a PHP MySQL based development , used to create and manage classified ads website open source system . Osclass suffers from a SQL injection vulnerability. Because the input passed to the "/index.php" PHP script via the "itemsPerPage" HTTP GET parameter fails to filter user input, an...

SQL Injection in Osclass

High-Tech Bridge Security Research Lab discovered a high-risk SQL injection vulnerability in Osclass, a popular web-based software for building customized classifieds marketplace. The vulnerability can be exploited to gain access to potentially sensitive information in the application database an...

CVE-2014-8085

Unrestricted file upload vulnerability in the CWebContact::doModel method in oc-includes/osclass/controller/contact.php in OSClass before 3.4.3 allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in an...

CVE-2014-8084

Directory traversal vulnerability in oc-includes/osclass/controller/ajax.php in OSClass before 3.4.3 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the ajaxfile parameter in a custom action...

CVE-2014-8083

SQL injection vulnerability in the Search::setJsonAlert method in OSClass before 3.4.3 allows remote attackers to execute arbitrary SQL commands via the alert parameter in a search alert subscription action...

Unrestricted file upload

Unrestricted file upload vulnerability in the CWebContact::doModel method in oc-includes/osclass/controller/contact.php in OSClass before 3.4.3 allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in an...

Directory traversal

Directory traversal vulnerability in oc-includes/osclass/controller/ajax.php in OSClass before 3.4.3 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the ajaxfile parameter in a custom action...

Sql injection

SQL injection vulnerability in the Search::setJsonAlert method in OSClass before 3.4.3 allows remote attackers to execute arbitrary SQL commands via the alert parameter in a search alert subscription action...

CVE-2014-8085

Unrestricted file upload vulnerability in the CWebContact::doModel method in oc-includes/osclass/controller/contact.php in OSClass before 3.4.3 allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in an...

CVE-2014-8084

Directory traversal vulnerability in oc-includes/osclass/controller/ajax.php in OSClass before 3.4.3 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the ajaxfile parameter in a custom action...

CVE-2014-8083

SQL injection vulnerability in the Search::setJsonAlert method in OSClass before 3.4.3 allows remote attackers to execute arbitrary SQL commands via the alert parameter in a search alert subscription action...

CVE-2014-8083

SQL injection vulnerability in the Search::setJsonAlert method in OSClass before 3.4.3 allows remote attackers to execute arbitrary SQL commands via the alert parameter in a search alert subscription action...

CVE-2014-8084

OSClass before 3.4.3 is affected by CVE-2014-8084, a local file inclusion in the ajax.php controller (custom action). The flaw stems from unsanitized input passed via the ajaxfile/route mechanism, which is used to determine the file to require, allowing an attacker to include and execute arbitrar...

CVE-2014-8085

OSClass before 3.4.3 suffers an unrestricted file upload vulnerability in CWebContact::doModel (contact.php). The code fails to properly validate file extensions, allowing an unauthenticated attacker to upload a PHP file via the attachment option and, after enabling the feature, access it to exec...

CVE-2014-8085

Unrestricted file upload vulnerability in the CWebContact::doModel method in oc-includes/osclass/controller/contact.php in OSClass before 3.4.3 allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in an...

CVE-2014-8084

Directory traversal vulnerability in oc-includes/osclass/controller/ajax.php in OSClass before 3.4.3 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the ajaxfile parameter in a custom action...