Oscommerce vulnerabilities

CVE-2009-20006 [CRITICAL] CWE-434 CVE-2009-20006: osCommerce versions up to and including 2.2 RC2a contain a vulnerability in its administrative file osCommerce versions up to and including 2.2 RC2a contain a vulnerability in its administrative file manager utility (admin/file_manager.php). The interface allows file uploads and edits without sufficient input validation or access control. An unauthenticated attacker can craft a POST request to upload a .php file containing arbitrary code, which i

CVE-2023-6579 [CRITICAL] CWE-89 CVE-2023-6579: A vulnerability, which was classified as critical, has been found in osCommerce 4. Affected by this A vulnerability, which was classified as critical, has been found in osCommerce 4. Affected by this issue is some unknown functionality of the file /b2b-supermarket/shopping-cart of the component POST Parameter Handler. The manipulation of the argument estimate[country_id] leads to sql injection. The attack may be launched remotely. The identifier of

CVE-2008-0719 [HIGH] CWE-89 CVE-2008-0719: SQL injection vulnerability in customer_testimonials.php in the Customer Testimonials 3 and 3.1 Addo SQL injection vulnerability in customer_testimonials.php in the Customer Testimonials 3 and 3.1 Addon for osCommerce Online Merchant 2.2 allows remote attackers to execute arbitrary SQL commands via the testimonial_id parameter.

CVE-2020-27976 [CRITICAL] CWE-78 CVE-2020-27976: osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter can be passed to the application. This affects the PHP mail function, and the sendmail -f option.

CVE-2002-1991 [HIGH] CWE-94 CVE-2002-1991: PHP file inclusion vulnerability in osCommerce 2.1 execute arbitrary commands via the include_file p PHP file inclusion vulnerability in osCommerce 2.1 execute arbitrary commands via the include_file parameter to include_once.php.

CVE-2005-2330 [MEDIUM] CVE-2005-2330: Directory traversal vulnerability in extras/update.php in osCommerce 2.2 allows remote attackers to Directory traversal vulnerability in extras/update.php in osCommerce 2.2 allows remote attackers to read arbitrary files via (1) .. sequences or (2) a full pathname in the readme_file parameter.

CVE-2002-2019 [HIGH] CWE-94 CVE-2002-2019: PHP remote file inclusion vulnerability in include_once.php in osCommerce (a.k.a. Exchange Project) PHP remote file inclusion vulnerability in include_once.php in osCommerce (a.k.a. Exchange Project) 2.1 allows remote attackers to execute arbitrary PHP code via the include_file parameter.

CVE-2019-25495 [HIGH] CWE-89 CVE-2019-25495: osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to m osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the reviews_id parameter. Attackers can send GET requests to product_reviews_write.php with malicious reviews_id values using boolean-based SQL injection payloads to extract sensitive database info

CVE-2019-25497 [HIGH] CWE-89 CVE-2019-25497: osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to m osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the currency parameter. Attackers can send GET requests to shopping_cart.php with malicious currency values using boolean-based SQL injection payloads to extract sensitive database information.

CVE-2004-2021 [MEDIUM] CVE-2004-2021: Directory traversal vulnerability in file_manager.php in osCommerce 2.2 allows remote attackers to v Directory traversal vulnerability in file_manager.php in osCommerce 2.2 allows remote attackers to view arbitrary files via a .. (dot dot) in the filename argument.

CVE-2019-25496 [HIGH] CWE-89 CVE-2019-25496: osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to m osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the products_id parameter. Attackers can modify the products_id value in product_info.php requests and append boolean-based SQL injection payloads to extract sensitive database information.

CVE-2020-23360 [CRITICAL] CWE-697 CVE-2020-23360: oscommerce v2.3.4.1 has a functional problem in user registration and password rechecking, where a n oscommerce v2.3.4.1 has a functional problem in user registration and password rechecking, where a non-identical password can bypass the checks in /catalog/admin/administrators.php and /catalog/password_reset.php

CVE-2018-18573 [HIGH] CWE-94 CVE-2018-18573: osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Remo osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Remote authenticated administrators can upload new '.htaccess' files (e.g., omitting .php) and subsequently achieve arbitrary PHP code execution via a /catalog/admin/categories.php?cPath=&action=new_product URI.

CVE-2018-18572 [HIGH] CWE-434 CVE-2018-18572: osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Beca osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Because of this filter, script files with certain PHP-related extensions (such as .phtml and .php5) didn't execute in the application. But this filter didn't prevent the '.pht' extension. Thus, remote authenticated administrators can upload '.pht' files for

CVE-2005-1951 [MEDIUM] CVE-2005-1951: Multiple HTTP Response Splitting vulnerabilities in osCommerce 2.2 Milestone 2 and earlier allow rem Multiple HTTP Response Splitting vulnerabilities in osCommerce 2.2 Milestone 2 and earlier allow remote attackers to spoof web content and poison web caches via hex-encoded CRLF ("%0d%0a") sequences in the (1) products_id or (2) pid parameter to index.php or (3) goto parameter to banner.php.

CVE-2006-5190 [MEDIUM] CVE-2006-5190: Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 2.2 Milestone 2 Update 060817 allo Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 2.2 Milestone 2 Update 060817 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter in the (a) banner_manager.php, (b) banner_statistics.php, (c) countries.php, (d) currencies.php, (e) languages.php, (f) manufacturers.php, (g) newsletters.php, (h) orders_statu

CVE-2003-1219 [MEDIUM] CVE-2003-1219: Cross-site scripting (XSS) vulnerability in the tep_href_link function in html_output.php for osComm Cross-site scripting (XSS) vulnerability in the tep_href_link function in html_output.php for osCommerce before 2.2-MS3 allows remote attackers to inject arbitrary web script or HTML via the osCsid parameter.

CVE-2011-4543 [HIGH] CWE-22 CVE-2011-4543: Multiple directory traversal vulnerabilities in osCommerce 3.0.2 allow remote attackers to include a Multiple directory traversal vulnerabilities in osCommerce 3.0.2 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) set or (2) module parameter to (a) OM/Core/Site/Admin/Application/templates_modules/pages/info.php, (b) OM/Core/Site/Admin/Application/templates_modules/pages/edit.php, or (c) OM/Core/Site/Admi

CVE-2020-27975 [HIGH] CWE-352 CVE-2020-27975: osCommerce Phoenix CE before 1.0.5.4 allows admin/define_language.php CSRF. osCommerce Phoenix CE before 1.0.5.4 allows admin/define_language.php CSRF.

CVE-2006-4297 [HIGH] CVE-2006-4297: SQL injection vulnerability in shopping_cart.php in osCommerce before 2.2 Milestone 2 060817 allows SQL injection vulnerability in shopping_cart.php in osCommerce before 2.2 Milestone 2 060817 allows remote attackers to execute arbitrary SQL commands via id array parameters.