SQL Injection Flaw in osCommerce Online Merchant by osCommerce
CVE-2014-10033
Currently unrated
Key Information:
- Vendor
Oscommerce
- Status
- Vendor
- CVE Published:
- 13 January 2015
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2014-10033?
A SQL injection vulnerability exists in the update_zone function located in catalog/admin/geo_zones.php of osCommerce Online Merchant versions up to 2.3.3.4. This flaw allows remote administrators to manipulate SQL queries by injecting arbitrary SQL commands through the zID parameter during a list action. Successful exploitation can lead to unauthorized data access and database manipulation, posing significant risks to the integrity and confidentiality of web applications based on this platform.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.