Description
osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the products_id parameter. Attackers can modify the products_id value in product_info.php requests and append boolean-based SQL injection payloads to extract sensitive database information.
Remediation
References
Related Vulnerabilities
WordPress Plugin Ultimate Appointment Booking & Scheduling Cross-Site Scripting (1.1.9)
Moodle Exposure of Resource to Wrong Sphere Vulnerability (CVE-2017-7490)
Django Improper Handling of Length Parameter Inconsistency Vulnerability (CVE-2024-39614)
Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-0798)
MongoDb Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2026-13074)