ID de Prueba:	1.3.6.1.4.1.25623.1.0.805566
Categoría:	Web application abuses
Título:	osCMax e-commerce/shopping-cart Multiple Vulnerabilities
Resumen:	osCMax is prone to multiple vulnerabilities.
Descripción:	Summary: osCMax is prone to multiple vulnerabilities. Vulnerability Insight: Multiple flaws exist as, - Input passed via 'username' POST parameter to /admin/login.php script, 'pageTitle' GET parameter to /admin/new_attributes_include.php script, the 'sb_id', 'sb_key', 'gc_id', 'gc_key' and 'path' POST parameters to /admin/htaccess.php script, the 'title' GET parameter to /admin/information_form.php script, the 'search' GET parameter to /admin/xsell.php script, the 'gross' and 'max' GET parameters to /admin/stats_products_purchased.php script, the 'status' GET parameter to /admin/stats_monthly_sales.php script, the 'sorted' GET parameter to /admin/stats_customers.php script, the 'information_id' GET parameter to /admin/information_manager.php script, the 'zID' GET parameter to /admin/geo_zones.php script, the 'current_product_id' and 'cPath' GET parameters to /admin/new_attributes_include.php script is not properly sanitised before being returned to the user. - Input passed via the 'status' GET parameter to /admin/stats_monthly_sales.php script, the 'country' POST parameter to /admin/create_account_process.php script, the 'username' POST parameter to /admin/login.php script is not properly sanitised before being used in SQL query. Vulnerability Impact: Successful exploitation will allow remote attackers to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data and also create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server. Affected Software/OS: osCMax before version 2.5.1 Solution: Upgrade to osCMax version 2.5.1 or later. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2012-1665 Bugtraq: 20120404 Multiple vulnerabilities in osCmax (Google Search) http://archives.neohapsis.com/archives/bugtraq/2012-04/0021.html https://www.htbridge.com/advisory/HTB23081 http://www.osvdb.org/80900 http://www.osvdb.org/80901 http://www.osvdb.org/80902 Common Vulnerability Exposure (CVE) ID: CVE-2012-1664 http://www.osvdb.org/80903 http://www.osvdb.org/80904 http://www.osvdb.org/80905 http://www.osvdb.org/80906 http://www.osvdb.org/80907 http://www.osvdb.org/80908 http://www.osvdb.org/80909 http://www.osvdb.org/80910 http://www.osvdb.org/80911 http://www.osvdb.org/80912
Copyright	Copyright (C) 2015 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.