PT-2002-2712 · Oscommerce · Oscommerce

Publicado 2002-12-31 · Atualizado 2008-09-05 · CVE-2002-1991

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions osCommerce version 2.1

Description The issue allows for the execution of arbitrary commands via the include file parameter to the include once.php file. This is a PHP file inclusion vulnerability.

Recommendations For osCommerce version 2.1, consider restricting access to the include once.php file to minimize the risk of exploitation. As a temporary workaround, avoid using the include file parameter until a patch is available.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2002-1991

Produtos afetados

Oscommerce

Referências · 8

• 🔥 http://securityfocus.com/bid/5037 · Exploit
• 🔥 https://exploit-db.com/exploits/21563 · Exploit
• 🔥 http://oscommerce.com/about.php/news,72 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1991 · Nota
• http://iss.net/security_center/static/9369.php · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-1991 · Nota de Segurança
• http://oscommerce.com/about.php/news%2C72 · Nota
• http://online.securityfocus.com/archive/1/277312 · Nota