CVE-2020-27976

CVE-2020-27976 Exploit osCommerce Phoenix CE . This has produced the best results during testing. Newlines in the payload are replaced with spaces before upload. ================== Sources: https://www.tenable.com/cve/CVE-2020-27976 https://herolab.usd.de/security-advisories/usd-2020-0026/...

CVE-2020-27976

osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter can be passed to the application. This affects the PHP mail function, and the sendmail -f option...

osCommerce CE Phoenix OS Command Injection Vulnerability

OsCommerce is an e-commerce and online store management software program.CE Phoenix is the official community version of osCommerce. An OS command injection vulnerability exists in osCommerce CE Phoenix versions prior to 1.0.5.4. An attacker can exploit this vulnerability to execute arbitrary cod...

osCommerce Phoenix CE Cross-Site Request Forgery Vulnerability

OsCommerce is an e-commerce and online store management software program.CE Phoenix is the official community version of osCommerce. A cross-site request forgery vulnerability exists in admin/definelanguage.php in osCommerce CE Phoenix versions prior to 1.0.5.4. No details of the vulnerability ar...

CVE-2020-27976

osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter can be passed to the application. This affects the PHP mail function, and the sendmail -f option...

CVE-2020-27975

osCommerce Phoenix CE before 1.0.5.4 allows admin/definelanguage.php CSRF...

CVE-2020-27976

osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter can be passed to the application. This affects the PHP mail function, and the sendmail -f option...

PT-2020-16883

Name of the Vulnerable Software and Affected Versions osCommerce Phoenix CE versions prior to 1.0.5.4 Description The issue allows for OS command injection remotely. It is caused by a vulnerable from POST parameter in the admin/mail.php file, which affects the PHP mail function and the sendmail -...

PT-2020-16882

Name of the Vulnerable Software and Affected Versions osCommerce Phoenix CE versions prior to 1.0.5.4 Description The issue allows for a CSRF attack in the admin/define language.php file. Recommendations For versions prior to 1.0.5.4, update to version 1.0.5.4 or later to resolve the issue...

CVE-2020-27975: Cross-Site Request Forgery (CSRF)

osCommerce Phoenix CE before 1.0.5.4 allows admin/definelanguage.php CSRF...

CVE-2020-27976: Improper Neutralization of Special Elements used in an OS Command

osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter can be passed to the application. This affects the PHP mail function, and the sendmail -f option...