PT-2014-6281 · Ol Commerce · Ol-Commerce

Published 2014-07-28 · Updated 2014-07-29 · CVE-2014-5104

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ol-commerce version 2.1.1

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several parameters in different PHP files, including the a country parameter in the "affiliate signup.php" file, the affiliate banner id parameter in the "affiliate show banner.php" file, the country parameter in the "create account.php" file, or the entry country id parameter in the "admin/create account.php" file.

Recommendations For ol-commerce version 2.1.1, consider restricting access to the vulnerable parameters a country, affiliate banner id, country, and entry country id in their respective PHP files until a patch is available. As a temporary workaround, avoid using these parameters in the affected API endpoints or files.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2014-5104

Affected Products

Ol-Commerce

References · 7

• 🔥 https://exploit-db.com/exploits/39346 · Exploit
• 🔥 https://exploit-db.com/exploits/39344 · Exploit
• 🔥 http://securityfocus.com/bid/68719 · Exploit
• 🔥 http://packetstormsecurity.com/files/127521/OL-Commerce-2.1.1-Cross-Site-Scripting-SQL-Injection.html · Exploit
• 🔥 https://exploit-db.com/exploits/39343 · Exploit
• 🔥 https://exploit-db.com/exploits/39345 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-5104 · Security Note