PT-2008-5469 · Oscommerce · Oscommerce

John Cobb · Published 2008-09-22 · Updated 2018-10-11 · CVE-2008-4170

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions osCommerce version 2.2 RC 2a

Description The issue allows remote attackers to obtain sensitive information via an invalid dob parameter in the create account.php file. This reveals the installation path in an error message.

Recommendations For osCommerce version 2.2 RC 2a, consider modifying the create account.php file to handle invalid dob parameters without revealing sensitive information, such as the installation path, in error messages. As a temporary workaround, restrict access to the create account.php file to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2008-4170

Affected Products

Oscommerce

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2008-4170 · Security Note
• http://securityfocus.com/bid/31209 · Note
• http://securityfocus.com/archive/1/496417/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45193 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4170 · Note
• http://securityreason.com/securityalert/4293 · Note