Search criteria

3 vulnerabilities by oscmax

CVE-2012-6691 (GCVE-0-2012-6691)

Vulnerability from cvelistv5 – Published: 2015-05-20 18:00 – Updated: 2024-08-06 21:36
VLAI
Summary
Multiple cross-site request forgery (CSRF) vulnerabilities in the admin panel in osCMax before 2.5.1 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the (1) status parameter to admin/stats_monthly_sales.php or (2) country parameter in a process action to admin/create_account_process.php.
Severity
No CVSS data available.
CWE
  • n/a
Assigner
References
Date Public
2012-04-04 00:00
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T21:36:02.322Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.htbridge.com/advisory/HTB23081"
          },
          {
            "name": "20120404 Multiple vulnerabilities in osCmax",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://archives.neohapsis.com/archives/bugtraq/2012-04/0021.html"
          },
          {
            "name": "74753",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/74753"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oscmax.com/blog/michael_s/oscmax_v251_has_been_released_security_update"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-04-04T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in the admin panel in osCMax before 2.5.1 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the (1) status parameter to admin/stats_monthly_sales.php or (2) country parameter in a process action to admin/create_account_process.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2015-06-02T16:57:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.htbridge.com/advisory/HTB23081"
        },
        {
          "name": "20120404 Multiple vulnerabilities in osCmax",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://archives.neohapsis.com/archives/bugtraq/2012-04/0021.html"
        },
        {
          "name": "74753",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/74753"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oscmax.com/blog/michael_s/oscmax_v251_has_been_released_security_update"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-6691",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in the admin panel in osCMax before 2.5.1 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the (1) status parameter to admin/stats_monthly_sales.php or (2) country parameter in a process action to admin/create_account_process.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.htbridge.com/advisory/HTB23081",
              "refsource": "MISC",
              "url": "https://www.htbridge.com/advisory/HTB23081"
            },
            {
              "name": "20120404 Multiple vulnerabilities in osCmax",
              "refsource": "BUGTRAQ",
              "url": "http://archives.neohapsis.com/archives/bugtraq/2012-04/0021.html"
            },
            {
              "name": "74753",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/74753"
            },
            {
              "name": "http://www.oscmax.com/blog/michael_s/oscmax_v251_has_been_released_security_update",
              "refsource": "CONFIRM",
              "url": "http://www.oscmax.com/blog/michael_s/oscmax_v251_has_been_released_security_update"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2012-6691",
    "datePublished": "2015-05-20T18:00:00.000Z",
    "dateReserved": "2015-05-20T00:00:00.000Z",
    "dateUpdated": "2024-08-06T21:36:02.322Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-1665 (GCVE-0-2012-1665)

Vulnerability from cvelistv5 – Published: 2015-05-20 18:00 – Updated: 2024-08-06 19:01
VLAI
Summary
Multiple SQL injection vulnerabilities in the admin panel in osCMax before 2.5.1 allow (1) remote attackers to execute arbitrary SQL commands via the username parameter in a process action to admin/login.php or (2) remote administrators to execute arbitrary SQL commands via the status parameter to admin/stats_monthly_sales.php or (3) country parameter in a process action to admin/create_account_process.php.
Severity
No CVSS data available.
CWE
  • n/a
Assigner
References
URL Tags
https://www.htbridge.com/advisory/HTB23081 x_refsource_MISC
http://www.osvdb.org/80901 vdb-entryx_refsource_OSVDB
http://archives.neohapsis.com/archives/bugtraq/20… mailing-listx_refsource_BUGTRAQ
http://bugtrack.oscmax.com/view.php?id=1165 x_refsource_CONFIRM
http://www.osvdb.org/80902 vdb-entryx_refsource_OSVDB
http://www.osvdb.org/80900 vdb-entryx_refsource_OSVDB
http://www.oscmax.com/blog/michael_s/oscmax_v251_… x_refsource_CONFIRM
Date Public
2012-04-04 00:00
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T19:01:02.941Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.htbridge.com/advisory/HTB23081"
          },
          {
            "name": "80901",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/80901"
          },
          {
            "name": "20120404 Multiple vulnerabilities in osCmax",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://archives.neohapsis.com/archives/bugtraq/2012-04/0021.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://bugtrack.oscmax.com/view.php?id=1165"
          },
          {
            "name": "80902",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/80902"
          },
          {
            "name": "80900",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/80900"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oscmax.com/blog/michael_s/oscmax_v251_has_been_released_security_update"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-04-04T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple SQL injection vulnerabilities in the admin panel in osCMax before 2.5.1 allow (1) remote attackers to execute arbitrary SQL commands via the username parameter in a process action to admin/login.php or (2) remote administrators to execute arbitrary SQL commands via the status parameter to admin/stats_monthly_sales.php or (3) country parameter in a process action to admin/create_account_process.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2015-05-20T17:57:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.htbridge.com/advisory/HTB23081"
        },
        {
          "name": "80901",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/80901"
        },
        {
          "name": "20120404 Multiple vulnerabilities in osCmax",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://archives.neohapsis.com/archives/bugtraq/2012-04/0021.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://bugtrack.oscmax.com/view.php?id=1165"
        },
        {
          "name": "80902",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/80902"
        },
        {
          "name": "80900",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/80900"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oscmax.com/blog/michael_s/oscmax_v251_has_been_released_security_update"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-1665",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple SQL injection vulnerabilities in the admin panel in osCMax before 2.5.1 allow (1) remote attackers to execute arbitrary SQL commands via the username parameter in a process action to admin/login.php or (2) remote administrators to execute arbitrary SQL commands via the status parameter to admin/stats_monthly_sales.php or (3) country parameter in a process action to admin/create_account_process.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.htbridge.com/advisory/HTB23081",
              "refsource": "MISC",
              "url": "https://www.htbridge.com/advisory/HTB23081"
            },
            {
              "name": "80901",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/80901"
            },
            {
              "name": "20120404 Multiple vulnerabilities in osCmax",
              "refsource": "BUGTRAQ",
              "url": "http://archives.neohapsis.com/archives/bugtraq/2012-04/0021.html"
            },
            {
              "name": "http://bugtrack.oscmax.com/view.php?id=1165",
              "refsource": "CONFIRM",
              "url": "http://bugtrack.oscmax.com/view.php?id=1165"
            },
            {
              "name": "80902",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/80902"
            },
            {
              "name": "80900",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/80900"
            },
            {
              "name": "http://www.oscmax.com/blog/michael_s/oscmax_v251_has_been_released_security_update",
              "refsource": "CONFIRM",
              "url": "http://www.oscmax.com/blog/michael_s/oscmax_v251_has_been_released_security_update"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2012-1665",
    "datePublished": "2015-05-20T18:00:00.000Z",
    "dateReserved": "2012-03-14T00:00:00.000Z",
    "dateUpdated": "2024-08-06T19:01:02.941Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-1664 (GCVE-0-2012-1664)

Vulnerability from cvelistv5 – Published: 2015-05-20 18:00 – Updated: 2024-08-06 19:01
VLAI
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the admin panel in osCMax before 2.5.1 allow remote attackers to inject arbitrary web script or HTML via the (1) username parameter in a process action to admin/login.php; (2) pageTitle, (3) current_product_id, or (4) cPath parameter to admin/new_attributes_include.php; (5) sb_id, (6) sb_key, (7) gc_id, (8) gc_key, or (9) path parameter to admin/htaccess.php; (10) title parameter to admin/information_form.php; (11) search parameter to admin/xsell.php; (12) gross or (13) max parameter to admin/stats_products_purchased.php; (14) status parameter to admin/stats_monthly_sales.php; (15) sorted parameter to admin/stats_customers.php; (16) information_id parameter to /admin/information_manager.php; or (17) zID parameter to /admin/geo_zones.php.
Severity
No CVSS data available.
CWE
  • n/a
Assigner
References
URL Tags
http://www.osvdb.org/80906 vdb-entryx_refsource_OSVDB
https://www.htbridge.com/advisory/HTB23081 x_refsource_MISC
http://www.osvdb.org/80912 vdb-entryx_refsource_OSVDB
http://www.osvdb.org/80905 vdb-entryx_refsource_OSVDB
http://www.osvdb.org/80908 vdb-entryx_refsource_OSVDB
http://archives.neohapsis.com/archives/bugtraq/20… mailing-listx_refsource_BUGTRAQ
http://www.osvdb.org/80910 vdb-entryx_refsource_OSVDB
http://www.osvdb.org/80911 vdb-entryx_refsource_OSVDB
http://bugtrack.oscmax.com/view.php?id=1165 x_refsource_CONFIRM
http://www.oscmax.com/blog/michael_s/oscmax_v251_… x_refsource_CONFIRM
http://www.osvdb.org/80904 vdb-entryx_refsource_OSVDB
http://www.osvdb.org/80909 vdb-entryx_refsource_OSVDB
http://www.osvdb.org/80907 vdb-entryx_refsource_OSVDB
http://www.osvdb.org/80903 vdb-entryx_refsource_OSVDB
Date Public
2012-04-04 00:00
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T19:01:02.908Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "80906",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/80906"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.htbridge.com/advisory/HTB23081"
          },
          {
            "name": "80912",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/80912"
          },
          {
            "name": "80905",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/80905"
          },
          {
            "name": "80908",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/80908"
          },
          {
            "name": "20120404 Multiple vulnerabilities in osCmax",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://archives.neohapsis.com/archives/bugtraq/2012-04/0021.html"
          },
          {
            "name": "80910",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/80910"
          },
          {
            "name": "80911",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/80911"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://bugtrack.oscmax.com/view.php?id=1165"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oscmax.com/blog/michael_s/oscmax_v251_has_been_released_security_update"
          },
          {
            "name": "80904",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/80904"
          },
          {
            "name": "80909",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/80909"
          },
          {
            "name": "80907",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/80907"
          },
          {
            "name": "80903",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/80903"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-04-04T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site scripting (XSS) vulnerabilities in the admin panel in osCMax before 2.5.1 allow remote attackers to inject arbitrary web script or HTML via the (1) username parameter in a process action to admin/login.php; (2) pageTitle, (3) current_product_id, or (4) cPath parameter to admin/new_attributes_include.php; (5) sb_id, (6) sb_key, (7) gc_id, (8) gc_key, or (9) path parameter to admin/htaccess.php; (10) title parameter to admin/information_form.php; (11) search parameter to admin/xsell.php; (12) gross or (13) max parameter to admin/stats_products_purchased.php; (14) status parameter to admin/stats_monthly_sales.php; (15) sorted parameter to admin/stats_customers.php; (16) information_id parameter to /admin/information_manager.php; or (17) zID parameter to /admin/geo_zones.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2015-05-20T17:57:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "80906",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/80906"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.htbridge.com/advisory/HTB23081"
        },
        {
          "name": "80912",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/80912"
        },
        {
          "name": "80905",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/80905"
        },
        {
          "name": "80908",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/80908"
        },
        {
          "name": "20120404 Multiple vulnerabilities in osCmax",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://archives.neohapsis.com/archives/bugtraq/2012-04/0021.html"
        },
        {
          "name": "80910",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/80910"
        },
        {
          "name": "80911",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/80911"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://bugtrack.oscmax.com/view.php?id=1165"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oscmax.com/blog/michael_s/oscmax_v251_has_been_released_security_update"
        },
        {
          "name": "80904",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/80904"
        },
        {
          "name": "80909",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/80909"
        },
        {
          "name": "80907",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/80907"
        },
        {
          "name": "80903",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/80903"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-1664",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple cross-site scripting (XSS) vulnerabilities in the admin panel in osCMax before 2.5.1 allow remote attackers to inject arbitrary web script or HTML via the (1) username parameter in a process action to admin/login.php; (2) pageTitle, (3) current_product_id, or (4) cPath parameter to admin/new_attributes_include.php; (5) sb_id, (6) sb_key, (7) gc_id, (8) gc_key, or (9) path parameter to admin/htaccess.php; (10) title parameter to admin/information_form.php; (11) search parameter to admin/xsell.php; (12) gross or (13) max parameter to admin/stats_products_purchased.php; (14) status parameter to admin/stats_monthly_sales.php; (15) sorted parameter to admin/stats_customers.php; (16) information_id parameter to /admin/information_manager.php; or (17) zID parameter to /admin/geo_zones.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "80906",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/80906"
            },
            {
              "name": "https://www.htbridge.com/advisory/HTB23081",
              "refsource": "MISC",
              "url": "https://www.htbridge.com/advisory/HTB23081"
            },
            {
              "name": "80912",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/80912"
            },
            {
              "name": "80905",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/80905"
            },
            {
              "name": "80908",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/80908"
            },
            {
              "name": "20120404 Multiple vulnerabilities in osCmax",
              "refsource": "BUGTRAQ",
              "url": "http://archives.neohapsis.com/archives/bugtraq/2012-04/0021.html"
            },
            {
              "name": "80910",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/80910"
            },
            {
              "name": "80911",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/80911"
            },
            {
              "name": "http://bugtrack.oscmax.com/view.php?id=1165",
              "refsource": "CONFIRM",
              "url": "http://bugtrack.oscmax.com/view.php?id=1165"
            },
            {
              "name": "http://www.oscmax.com/blog/michael_s/oscmax_v251_has_been_released_security_update",
              "refsource": "CONFIRM",
              "url": "http://www.oscmax.com/blog/michael_s/oscmax_v251_has_been_released_security_update"
            },
            {
              "name": "80904",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/80904"
            },
            {
              "name": "80909",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/80909"
            },
            {
              "name": "80907",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/80907"
            },
            {
              "name": "80903",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/80903"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2012-1664",
    "datePublished": "2015-05-20T18:00:00.000Z",
    "dateReserved": "2012-03-14T00:00:00.000Z",
    "dateUpdated": "2024-08-06T19:01:02.908Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}