PT-2015-3520 · Oscmax · Oscmax

Published 2015-05-20 · Updated 2015-05-21 · CVE-2012-1665

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions osCMax versions prior to 2.5.1

Description The issue concerns SQL injection vulnerabilities in the admin panel. These vulnerabilities allow remote attackers to execute arbitrary SQL commands via specific parameters in various PHP files. For example, the username parameter in a process action to "admin/login.php" is vulnerable. Additionally, remote administrators can execute arbitrary SQL commands via the status parameter to "admin/stats monthly sales.php" or the country parameter in a process action to "admin/create account process.php".

Recommendations For osCMax versions prior to 2.5.1, update to version 2.5.1 or later to resolve the issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2012-1665

Affected Products

Oscmax

References · 10

• 🔥 https://exploit-db.com/exploits/37047 · Exploit
• 🔥 https://exploit-db.com/exploits/37048 · Exploit
• 🔥 https://htbridge.com/advisory/HTB23081 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-1665 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2012-04/0021.html · Note
• http://oscmax.com/blog/michael_s/oscmax_v251_has_been_released_security_update · Note
• http://bugtrack.oscmax.com/view.php?id=1165 · Note
• http://osvdb.org/80902 · Note
• http://osvdb.org/80901 · Note
• http://osvdb.org/80900 · Note