PT-2015-3519 · Oscmax · Oscmax

Publicado

2015-05-20

·

Atualizado

2015-05-21

·

CVE-2012-1664

CVSS v2.0

4.3

Média

VetorAV:N/AC:M/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions osCMax versions prior to 2.5.1
Description The issue allows remote attackers to inject arbitrary web script or HTML via various parameters in different admin panel files. The affected parameters include username in 'admin/login.php', pageTitle, current product id, cPath in 'admin/new attributes include.php', sb id, sb key, gc id, gc key, path in 'admin/htaccess.php', title in 'admin/information form.php', search in 'admin/xsell.php', gross, max in 'admin/stats products purchased.php', status in 'admin/stats monthly sales.php', sorted in 'admin/stats customers.php', information id in 'admin/information manager.php', and zID in 'admin/geo zones.php'.
Recommendations For osCMax versions prior to 2.5.1, update to version 2.5.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the admin panel and limiting the use of the affected parameters until the update is applied. Avoid using the specified parameters in the affected API endpoints until the issue is resolved.

Exploit

Correção

XSS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2012-1664

Produtos afetados

Oscmax