cbcvebase.
CVE-2012-2991
published 2012-09-19

CVE-2012-2991: The PayPal (aka MODULE_PAYMENT_PAYPAL_STANDARD) module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set the payment…

PriorityP423medium5CVSS 2.0
AVNACLAuNCNIPAN
EPSS
1.14%
62.6th percentile
The PayPal (aka MODULE_PAYMENT_PAYPAL_STANDARD) module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self.

Affected

5 ranges
VendorProductVersion rangeFixed in
oscommerceonline_merchant<= 2.3.3—
oscommerceonline_merchant——
oscommerceonline_merchant——
oscommerceonline_merchant——
paypalwebsite_payments_standard_module<= 1.0—
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.