CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 4CVE-2008-4765 – osCommerce Poll Booth 2.0 AddOn - 'pollbooth.php' SQL Injection
https://notcve.org/view.php?id=CVE-2008-4765
SQL injection vulnerability in pollBooth.php in osCommerce Poll Booth Add-On 2.0 allows remote attackers to execute arbitrary SQL commands via the pollID parameter in a results operation. NOTE: this issue was disclosed by an unreliable researcher, so it might be incorrect. Vulnerabilidad de inyección SQL en pollBooth.php de osCommerce Poll Booth Add-On v2.0; permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro pollID en una operación "results" (resultado). NOTA: Esta vulnerabilidad ha sido reportada por un investigador de poca confianza, por lo que puede tener incorrecciones. • https://www.exploit-db.com/exploits/31640 https://www.exploit-db.com/exploits/5436 http://packetstormsecurity.org/0804-exploits/pollbooth20-sql.txt http://www.securityfocus.com/bid/28752 https://exchange.xforce.ibmcloud.com/vulnerabilities/41796 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2008-4170
https://notcve.org/view.php?id=CVE-2008-4170
create_account.php in osCommerce 2.2 RC 2a allows remote attackers to obtain sensitive information via an invalid dob parameter, which reveals the installation path in an error message. create_account.php en osCommerce 2.2 RC 2a, permite a atacantes remotos obtener información sensible a través de un parámetro "dob" inválido, lo que muestra el directorio de instalación en un mensaje de error. • http://securityreason.com/securityalert/4293 http://www.securityfocus.com/archive/1/496417/100/0/threaded http://www.securityfocus.com/bid/31209 https://exchange.xforce.ibmcloud.com/vulnerabilities/45193 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 2CVE-2008-0719 – osCommerce Addon Customer Testimonials 3.1 - SQL Injection
https://notcve.org/view.php?id=CVE-2008-0719
SQL injection vulnerability in customer_testimonials.php in the Customer Testimonials 3 and 3.1 Addon for osCommerce Online Merchant 2.2 allows remote attackers to execute arbitrary SQL commands via the testimonial_id parameter. Vulnerabilidad de inyección SQL en customer_testimonials.php de Customer Testimonials 3 y 3.1 Addon para osCommerce Online Merchant 2.2. Permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro testimonial_id. • https://www.exploit-db.com/exploits/5075 http://secunia.com/advisories/28831 http://www.securityfocus.com/bid/27664 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2007-1477
https://notcve.org/view.php?id=CVE-2007-1477
Directory traversal vulnerability in index.php in PHP Point Of Sale for osCommerce 1.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the cfg_language parameter. NOTE: this issue has been disputed by CVE, since the cfg_language variable is configured upon proper product installation ** EN DISPUTA ** Una vulnerabilidad de salto de directorio en index.php en PHP Point Of Sale para osCommerce versión 1.1 permite que atacantes remotos incluyan y ejecuten archivos locales arbitrarios mediante un ".." (punto punto) en el parámetro cfg_language. NOTA: esta vulnerabilidad ha sido impugnada por el CVE, desde que la variable cfg_language es configurada sobre una instalación del producto adecuada. • http://attrition.org/pipermail/vim/2007-April/001564.html http://securityreason.com/securityalert/2426 http://www.securityfocus.com/archive/1/462970/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/33006 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2006-6533
https://notcve.org/view.php?id=CVE-2006-6533
Directory traversal vulnerability in admin/templates_boxes_layout.php in osCommerce 3.0a3 allows remote attackers to include and execute arbitrary PHP files via a .. (dot dot) in the filter parameter. NOTE: this issue can be leveraged to obtain full path information in error messages. Vulnerabilidad de escalado de directorio en admin/templates_boxes_layout.php en osCommerce 3.0a3 permite a atacantes remotos incluir y ejecutar ficheros PHP de su elección mediante un .. (punto punto) a través del parámetro filter. NOTA. • http://lostmon.blogspot.com/2006/12/oscommerce-traversal-arbitrary-file.html http://securitytracker.com/id?1017353 http://www.securityfocus.com/bid/21477 http://www.vupen.com/english/advisories/2006/4895 https://exchange.xforce.ibmcloud.com/vulnerabilities/30767 •