Published: 20/05/2015 Updated: 21/05/2015

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 475

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Subscribe to Oscmax

Multiple cross-site scripting (XSS) vulnerabilities in the admin panel in osCMax prior to 2.5.1 allow remote malicious users to inject arbitrary web script or HTML via the (1) username parameter in a process action to admin/login.php; (2) pageTitle, (3) current_product_id, or (4) cPath parameter to admin/new_attributes_include.php; (5) sb_id, (6) sb_key, (7) gc_id, (8) gc_key, or (9) path parameter to admin/htaccess.php; (10) title parameter to admin/information_form.php; (11) search parameter to admin/xsell.php; (12) gross or (13) max parameter to admin/stats_products_purchased.php; (14) status parameter to admin/stats_monthly_sales.php; (15) sorted parameter to admin/stats_customers.php; (16) information_id parameter to /admin/information_manager.php; or (17) zID parameter to /admin/geo_zones.php.

Vulnerable Product	Search on Vulmon	Subscribe to Product
oscmax oscmax

osCmax version 250 suffers from cross site scripting and remote SQL injection vulnerabilities ...

source: wwwsecurityfocuscom/bid/52886/info osCMax is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compro ...

source: wwwsecurityfocuscom/bid/52886/info osCMax is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the ...

source: wwwsecurityfocuscom/bid/52886/info osCMax is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the app ...

source: wwwsecurityfocuscom/bid/52886/info osCMax is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise ...

source: wwwsecurityfocuscom/bid/52886/info osCMax is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, co ...

source: wwwsecurityfocuscom/bid/52886/info osCMax is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, comp ...

source: wwwsecurityfocuscom/bid/52886/info osCMax is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromi ...

source: wwwsecurityfocuscom/bid/52886/info osCMax is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise t ...

source: wwwsecurityfocuscom/bid/52886/info osCMax is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the a ...

CWE-79 http://www.osvdb.org/80904 http://www.osvdb.org/80903 http://archives.neohapsis.com/archives/bugtraq/2012-04/0021.html http://bugtrack.oscmax.com/view.php?id=1165 http://www.osvdb.org/80907 http://www.osvdb.org/80909 http://www.osvdb.org/80911 http://www.osvdb.org/80905 http://www.oscmax.com/blog/michael_s/oscmax_v251_has_been_released_security_update http://www.osvdb.org/80912 http://www.osvdb.org/80910 https://www.htbridge.com/advisory/HTB23081 http://www.osvdb.org/80906 http://www.osvdb.org/80908 https://nvd.nist.gov https://packetstormsecurity.com/files/111559/osCmax-2.5.0-Cross-Site-Scripting-SQL-Injection.html https://www.exploit-db.com/exploits/37044/

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook