SQL Injection Vulnerabilities in OSClass by OSClass Team

CVE-2012-0973

What is CVE-2012-0973?

OSClass, prior to version 2.3.5, contains multiple SQL injection vulnerabilities that can be exploited by remote attackers. These vulnerabilities arise from improper handling of the sCategory parameter in index.php, specifically within the osc_search_category_id function located in oc-includes/osclass/helpers/hSearch.php, and the findBySlug function in oc-includes/osclass/model/Category.php. Attackers can leverage these flaws to inject and execute arbitrary SQL commands, potentially compromising the integrity of the database and exposing sensitive data.

References