Description
osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the currency parameter. Attackers can send GET requests to shopping_cart.php with malicious currency values using boolean-based SQL injection payloads to extract sensitive database information.
Remediation
References
Related Vulnerabilities
WordPress Plugin Evarisk 'uploadPhotoApres.php' Arbitrary File Upload (5.1.5.4)
Roundcube Unspesificed Vulnerability (CVE-2018-1000071)
Apache HTTP Server Resource Management Errors Vulnerability (CVE-2014-0231)
Grafana CVE-2023-1387 Vulnerability (CVE-2023-1387)
Moodle Credentials Management Errors Vulnerability (CVE-2012-0794)