CVE-2012-5899

SAMEDIA LandShop 0.9.2 contains a Cross‑site Scripting (XSS) vulnerability in the admin/action/objects.php script. The issue arises from processing the OTR_HEADS[] parameter during an edit action, allowing remote attackers to inject arbitrary web script or HTML. Documents in the connected set con...

PT-2012-6180

Name of the Vulnerable Software and Affected Versions SAMEDIA LandShop version 0.9.2 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the OTR HEADS parameter in an edit action on the "admin/action/objects.php" endpoint. Recommendation...

PT-2012-6181

Name of the Vulnerable Software and Affected Versions SAMEDIA LandShop version 0.9.2 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the OB ID parameter in a single action to "admin/action/objects.php", the AREA ID parameter in a single...

CVE-2012-5899: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/action/objects.php in SAMEDIA LandShop 0.9.2 allows remote attackers to inject arbitrary web script or HTML via the OTRHEADS parameter in an edit action. NOTE: some of these details are obtained from third party information...

CVE-2012-5900: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in SAMEDIA LandShop 0.9.2 allow remote attackers to execute arbitrary SQL commands via the 1 OBID parameter in a single action to admin/action/objects.php, 2 AREAID parameter in a single action to admin/action/areas.php, or 3 start parameter in a show action...