osCommerce XSS Vulnerability (Mar 2003) - Active Check

osCommerce is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2003 k-otik.com Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2003-1219

CVE-2003-1219 affects osCommerce prior to version 2.2-MS3. The vulnerability is a cross-site scripting (XSS) flaw in the tep_href_link function in html_output.php that can be triggered by manipulating the osCsid parameter, enabling remote attackers to inject arbitrary scripts or HTML. Connected s...

CVE-2003-1219

Cross-site scripting XSS vulnerability in the tephreflink function in htmloutput.php for osCommerce before 2.2-MS3 allows remote attackers to inject arbitrary web script or HTML via the osCsid parameter...

CVE-2003-1219: Undefined Security Weakness

Cross-site scripting XSS vulnerability in the tephreflink function in htmloutput.php for osCommerce before 2.2-MS3 allows remote attackers to inject arbitrary web script or HTML via the osCsid parameter...

osCommerce Unprotected Admin Directory

The installation of osCommerce on the remote host apparently lets anyone access the application's admin directory, which means that they have complete administrative access to the site. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

osCommerce update.php readme_file Parameter Arbitrary File Disclosure

The osCommerce installation on the remote host has a supplementary script, 'extras/update.php', that fails to validate user-supplied input to the 'readmefile' parameter before using that to display a file. An attacker can exploit this flaw to read arbitrary files on the remote host, such as the...

CVE-2005-2330

Directory traversal vulnerability in extras/update.php in osCommerce 2.2 allows remote attackers to read arbitrary files via 1 .. sequences or 2 a full pathname in the readmefile parameter...

CVE-2005-2330

CVE-2005-2330 describes a directory-traversal flaw in osCommerce 2.2, specifically in the extras/update.php script. A remote attacker can exploit the readme_file parameter by using ".." sequences or a full pathname to read arbitrary files on the server. Impact is described as the ability to acces...

EUVD-2005-2331

Directory traversal vulnerability in extras/update.php in osCommerce 2.2 allows remote attackers to read arbitrary files via 1 .. sequences or 2 a full pathname in the readmefile parameter...

CVE-2005-2330

Directory traversal vulnerability in extras/update.php in osCommerce 2.2 allows remote attackers to read arbitrary files via 1 .. sequences or 2 a full pathname in the readmefile parameter...

CVE-2005-2330: Undefined Security Weakness

Directory traversal vulnerability in extras/update.php in osCommerce 2.2 allows remote attackers to read arbitrary files via 1 .. sequences or 2 a full pathname in the readmefile parameter...

osCommerce 2.2 - update.php Information Disclosure

osCommerce 2.2 - update.php Information Disclosure source: https://www.securityfocus.com/bid/14294/info osCommerce is prone to an information-disclosure vulnerability. An attacker could exploit this vulnerability to display the contents of any file normally readable by the webserver process...

osCommerce 2.2 - 'update.php' Information Disclosure

source: https://www.securityfocus.com/bid/14294/info osCommerce is prone to an information-disclosure vulnerability. An attacker could exploit this vulnerability to display the contents of any file normally readable by the webserver process. Successful exploitation would result in information...

CVE-2002-2019

PHP remote file inclusion vulnerability in includeonce.php in osCommerce a.k.a. Exchange Project 2.1 allows remote attackers to execute arbitrary PHP code via the includefile parameter...

CVE-2002-2019

CVE-2002-2019 refers to a PHP remote file inclusion vulnerability in the include_once.php file of osCommerce (Exchange Project) 2.1. The issue allows a remote attacker to execute arbitrary PHP code by supplying a crafted value to the include_file parameter. The affected software is osCommerce 2.1...

CVE-2002-1991

PHP file inclusion vulnerability in osCommerce 2.1 execute arbitrary commands via the includefile parameter to includeonce.php...

CVE-2002-1991

The CVE-2002-1991 entry describes a PHP file inclusion vulnerability in osCommerce 2.1, exploitable via the include_file parameter to include_once.php to execute arbitrary commands. Affected component: include_once.php in osCommerce 2.1. Impact is indicated as partial confidentiality/integrity/av...

CVE-2002-1991: Improper Control of Generation of Code

PHP file inclusion vulnerability in osCommerce 2.1 execute arbitrary commands via the includefile parameter to includeonce.php...

CVE-2002-2019: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in includeonce.php in osCommerce a.k.a. Exchange Project 2.1 allows remote attackers to execute arbitrary PHP code via the includefile parameter...

osCommerce application_top.php Multiple Parameter HTTP Response Splitting

The version of osCommerce on the remote host suffers from multiple HTTP response splitting vulnerabilities due to its failure to sanitize user-supplied input to various parameters of the 'includes/applicationtop.php' script, the 'goto' parameter of the 'banner.php' script, and possibly others. An...