Detections
Analytics
osCommerce shopping_cart.php id Array Parameters SQL Injection
high Nessus Plugin ID 22255
Language:
Synopsis
The remote web server contains a PHP application that is prone to a SQL injection attack.Description
The version of osCommerce installed on the remote host fails to properly sanitize input used for product attributes before using it in a database query in the 'shopping_cart.php' script. Provided PHP's 'magic_quotes_gpc' setting is disabled, an unauthenticated attacker may be able to exploit this issue to uncover sensitive information such as password hashes, modify data, launch attacks against the underlying database, etc.Solution
Upgrade to osCommerce 2.2 Milestone 2 Update 060817 or later.See Also
http://www.gulftech.org/?node=research&article_id=00110-08172006
Plugin Details
Severity: High
ID: 22255
File Name: oscommerce_22ms2u060817.nasl
Version: 1.26
Type: remote
Family: CGI abuses
Published: 8/23/2006
Updated: 6/1/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.6
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
Required KB Items: www/oscommerce
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Ease: No exploit is required
Vulnerability Publication Date: 8/17/2006
Reference Information
CVE: CVE-2006-4297