Multiple XSS Vulnerabilities in osCommerce CE Phoenix by osCommerce
CVE-2020-12058

6.1MEDIUM

Key Information:

Vendor: Oscommerce
Status: Ce Phoenix
Vendor: CVE Published:; 3 September 2020

What is CVE-2020-12058?

Several Cross-Site Scripting (XSS) vulnerabilities exist in osCommerce CE Phoenix prior to version 1.0.6.0, allowing attackers to inject and execute arbitrary JavaScript code. This exploitation can occur through various parameters in the admin module URLs, such as 'page', 'zpage', and 'spage', potentially compromising the integrity of the affected systems. Attackers can target catalog/admin/order_status.php, catalog/admin/tax_rates.php, catalog/admin/languages.php, catalog/admin/countries.php, catalog/admin/tax_classes.php, catalog/admin/reviews.php, or catalog/admin/zones.php, enabling them to manipulate web pages viewed by users. Addressing these vulnerabilities is critical for maintaining the security and integrity of e-commerce applications.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch