PT-2002-2712 · Oscommerce · Oscommerce

Published 2002-12-31 · Updated 2008-09-05 · CVE-2002-1991

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions osCommerce version 2.1

Description The issue allows for the execution of arbitrary commands via the include file parameter to the include once.php file. This is a PHP file inclusion vulnerability.

Recommendations For osCommerce version 2.1, consider restricting access to the include once.php file to minimize the risk of exploitation. As a temporary workaround, avoid using the include file parameter until a patch is available.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2002-1991

Affected Products

Oscommerce

References · 8

• 🔥 http://securityfocus.com/bid/5037 · Exploit
• 🔥 https://exploit-db.com/exploits/21563 · Exploit
• 🔥 http://oscommerce.com/about.php/news,72 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-1991 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1991 · Note
• http://iss.net/security_center/static/9369.php · Note
• http://oscommerce.com/about.php/news%2C72 · Note
• http://online.securityfocus.com/archive/1/277312 · Note