CVE-2005-2330

CVE-2005-2330 describes a directory-traversal flaw in osCommerce 2.2, specifically in the extras/update.php script. A remote attacker can exploit the readme_file parameter by using ".." sequences or a full pathname to read arbitrary files on the server. Impact is described as the ability to acces...

EUVD-2005-2331

Directory traversal vulnerability in extras/update.php in osCommerce 2.2 allows remote attackers to read arbitrary files via 1 .. sequences or 2 a full pathname in the readmefile parameter...

CVE-2005-2330

Directory traversal vulnerability in extras/update.php in osCommerce 2.2 allows remote attackers to read arbitrary files via 1 .. sequences or 2 a full pathname in the readmefile parameter...

CVE-2005-2330: Undefined Security Weakness

Directory traversal vulnerability in extras/update.php in osCommerce 2.2 allows remote attackers to read arbitrary files via 1 .. sequences or 2 a full pathname in the readmefile parameter...

osCommerce 2.2 - update.php Information Disclosure

osCommerce 2.2 - update.php Information Disclosure source: https://www.securityfocus.com/bid/14294/info osCommerce is prone to an information-disclosure vulnerability. An attacker could exploit this vulnerability to display the contents of any file normally readable by the webserver process...

osCommerce 2.2 - 'update.php' Information Disclosure

source: https://www.securityfocus.com/bid/14294/info osCommerce is prone to an information-disclosure vulnerability. An attacker could exploit this vulnerability to display the contents of any file normally readable by the webserver process. Successful exploitation would result in information...

CVE-2002-2019

PHP remote file inclusion vulnerability in includeonce.php in osCommerce a.k.a. Exchange Project 2.1 allows remote attackers to execute arbitrary PHP code via the includefile parameter...

CVE-2002-1991

The CVE-2002-1991 entry describes a PHP file inclusion vulnerability in osCommerce 2.1, exploitable via the include_file parameter to include_once.php to execute arbitrary commands. Affected component: include_once.php in osCommerce 2.1. Impact is indicated as partial confidentiality/integrity/av...

CVE-2002-1991

PHP file inclusion vulnerability in osCommerce 2.1 execute arbitrary commands via the includefile parameter to includeonce.php...

CVE-2002-2019

CVE-2002-2019 refers to a PHP remote file inclusion vulnerability in the include_once.php file of osCommerce (Exchange Project) 2.1. The issue allows a remote attacker to execute arbitrary PHP code by supplying a crafted value to the include_file parameter. The affected software is osCommerce 2.1...

CVE-2002-2019: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in includeonce.php in osCommerce a.k.a. Exchange Project 2.1 allows remote attackers to execute arbitrary PHP code via the includefile parameter...

CVE-2002-1991: Improper Control of Generation of Code

PHP file inclusion vulnerability in osCommerce 2.1 execute arbitrary commands via the includefile parameter to includeonce.php...

osCommerce application_top.php Multiple Parameter HTTP Response Splitting

The version of osCommerce on the remote host suffers from multiple HTTP response splitting vulnerabilities due to its failure to sanitize user-supplied input to various parameters of the 'includes/applicationtop.php' script, the 'goto' parameter of the 'banner.php' script, and possibly others. An...

osCommerce 2.1/2.2 - Multiple HTTP Response Splitting Vulnerabilities

source: https://www.securityfocus.com/bid/13979/info osCommerce is prone to multiple HTTP response splitting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. A remote attacker may exploit any of these vulnerabilities to influence or...

osCommerce 2.12.2 - Multiple HTTP Response Splitting Vulnerabilities

osCommerce 2.12.2 - Multiple HTTP Response Splitting Vulnerabilities source: https://www.securityfocus.com/bid/13979/info osCommerce is prone to multiple HTTP response splitting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. A remot...

CVE-2005-1951

Multiple HTTP Response Splitting vulnerabilities in osCommerce 2.2 Milestone 2 and earlier allow remote attackers to spoof web content and poison web caches via hex-encoded CRLF "%0d%0a" sequences in the 1 productsid or 2 pid parameter to index.php or 3 goto parameter to banner.php...

CVE-2005-1951

osCommerce 2.2 Milestone 2 and earlier are affected by CVE-2005-1951 due to HTTP Response Splitting in multiple parameters (products_id, pid in index.php and goto in banner.php). The vulnerability arises from hex-encoded CRLF sequences, enabling remote attackers to spoof content and potentially p...

CVE-2005-1951

Multiple HTTP Response Splitting vulnerabilities in osCommerce 2.2 Milestone 2 and earlier allow remote attackers to spoof web content and poison web caches via hex-encoded CRLF "%0d%0a" sequences in the 1 productsid or 2 pid parameter to index.php or 3 goto parameter to banner.php...

CVE-2005-1951: Undefined Security Weakness

Multiple HTTP Response Splitting vulnerabilities in osCommerce 2.2 Milestone 2 and earlier allow remote attackers to spoof web content and poison web caches via hex-encoded CRLF "%0d%0a" sequences in the 1 productsid or 2 pid parameter to index.php or 3 goto parameter to banner.php...

osCommere HTTP Response Splitting

GulfTech Security Research June 10th, 2005 Vendor : osCommerce URL : http://www.oscommerce.com/ Version : osCommerce 2.2 Milestone 2 && Earlier Risk : HTTP Response Splitting Description: osCommerce is a very popular eCommerce application that allows for individuals to host their own online shop...