CVE-2014-10033

EPSS 1.8%

SQL injection vulnerability in the update_zone function in catalog/admin/geo_zones.php in osCommerce Online Merchant 2.3.3.4 and earlier allows remote administrators to execute arbitrary SQL commands via the zID parameter in a list action.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencewww.exploit-db.com/exploits/31515unverified exploitdbwww.exploit-db.com/exploits/31515unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://osvdb.org/show/osvdb/103365 https://exchange.xforce.ibmcloud.com/vulnerabilities/91113 https://github.com/gburton/oscommerce2/commit/e4d90eccd7d9072ebe78da4c38fb048bfe31c902 http://www.exploit-db.com/exploits/31515 http://www.secgeek.net/oscommerce-v2x-sql-injection-vulnerability/