PT-2015-3519 · Oscmax · Oscmax
Published
2015-05-20
·
Updated
2015-05-21
·
CVE-2012-1664
CVSS v2.0
4.3
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
osCMax versions prior to 2.5.1
Description
The issue allows remote attackers to inject arbitrary web script or HTML via various parameters in different admin panel files. The affected parameters include
username in 'admin/login.php', pageTitle, current product id, cPath in 'admin/new attributes include.php', sb id, sb key, gc id, gc key, path in 'admin/htaccess.php', title in 'admin/information form.php', search in 'admin/xsell.php', gross, max in 'admin/stats products purchased.php', status in 'admin/stats monthly sales.php', sorted in 'admin/stats customers.php', information id in 'admin/information manager.php', and zID in 'admin/geo zones.php'.Recommendations
For osCMax versions prior to 2.5.1, update to version 2.5.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the admin panel and limiting the use of the affected parameters until the update is applied. Avoid using the specified parameters in the affected API endpoints until the issue is resolved.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Oscmax