CVE-2004-0300

EPSS 5.2%

SQL injection vulnerability in Online Store Kit 3.0 allows remote attackers to inject arbitrary SQL and gain unauthorized access via (1) the cat parameter in shop.php, (2) the id parameter in more.php, (3) the cat_manufacturer parameter in shop_by_brand.php, or (4) the id parameter in listing.php.

Affected products

n/a · n/a

public PoCs found — 4

exploitdbwww.exploit-db.com/exploits/23720unverified exploitdbwww.exploit-db.com/exploits/23711unverified exploitdbwww.exploit-db.com/exploits/23718unverified exploitdbwww.exploit-db.com/exploits/23719unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://marc.info/?l=bugtraq&m=107712117913185&w=2 http://secunia.com/advisories/10902/http://securitytracker.com/alerts/2004/Feb/1009092.html https://exchange.xforce.ibmcloud.com/vulnerabilities/15232 http://www.osvdb.org/3973 http://www.securityfocus.com/bid/9676 http://www.securityfocus.com/bid/9687 http://www.systemsecure.org/advisories/ssadvisory16022004.php http://www.zone-h.org/en/advisories/read/id=3972/