CVE-2012-1665

State: Published
Severity: Not scored
Published: May 20, 2015
Updated: Aug 6, 2024
Reserved: Mar 14, 2012

Description

Multiple SQL injection vulnerabilities in the admin panel in osCMax before 2.5.1 allow (1) remote attackers to execute arbitrary SQL commands via the username parameter in a process action to admin/login.php or (2) remote administrators to execute arbitrary SQL commands via the status parameter to admin/stats_monthly_sales.php or (3) country parameter in a process action to admin/create_account_process.php.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://www.htbridge.com/advisory/HTB23081
80901vdb-entry
20120404 Multiple vulnerabilities in osCmaxmailing-list
http://bugtrack.oscmax.com/view.php?id=1165
80902vdb-entry
80900vdb-entry
http://www.oscmax.com/blog/michael_s/oscmax_v251_has_been_released_security_update

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.