PT-2015-3520 · Oscmax · Oscmax

Publicado 2015-05-20 · Atualizado 2015-05-21 · CVE-2012-1665

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions osCMax versions prior to 2.5.1

Description The issue concerns SQL injection vulnerabilities in the admin panel. These vulnerabilities allow remote attackers to execute arbitrary SQL commands via specific parameters in various PHP files. For example, the username parameter in a process action to "admin/login.php" is vulnerable. Additionally, remote administrators can execute arbitrary SQL commands via the status parameter to "admin/stats monthly sales.php" or the country parameter in a process action to "admin/create account process.php".

Recommendations For osCMax versions prior to 2.5.1, update to version 2.5.1 or later to resolve the issue.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2012-1665

Produtos afetados

Oscmax

Referências · 10

• 🔥 https://exploit-db.com/exploits/37047 · Exploit
• 🔥 https://exploit-db.com/exploits/37048 · Exploit
• 🔥 https://htbridge.com/advisory/HTB23081 · Exploit
• http://archives.neohapsis.com/archives/bugtraq/2012-04/0021.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-1665 · Nota de Segurança
• http://oscmax.com/blog/michael_s/oscmax_v251_has_been_released_security_update · Nota
• http://bugtrack.oscmax.com/view.php?id=1165 · Nota
• http://osvdb.org/80902 · Nota
• http://osvdb.org/80901 · Nota
• http://osvdb.org/80900 · Nota