CVE-2005-4677: SQL Injection
Published Dec 31, 2005
·Updated
SQL injection vulnerability in additionalimages.php (aka the Additional Images module) before 1.14 in osCommerce allows remote attackers to execute arbitrary SQL commands via the productsid parameter to productinfo.php.
Affected Software
8 affected components
osCommerce oscommerce=1.11
osCommerce oscommerce=1.12
osCommerce oscommerce=1.1
osCommerce oscommerce=1.13
osCommerce oscommerce=1.1
osCommerce oscommerce=1.11
osCommerce oscommerce=1.12
osCommerce oscommerce=1.13
Event History
Dec 31, 2005
CVE Published
05:00 AM
Feb 1, 2006
CVE Published
via MITRE·07:00 AM
Data Sourced
via MITRE·07:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2005-4677?
CVE-2005-4677 has a medium severity rating due to the potential for arbitrary SQL command execution.
2
How do I fix CVE-2005-4677?
To fix CVE-2005-4677, upgrade your osCommerce version to 1.14 or higher, where the vulnerability has been addressed.
3
What are the affected versions related to CVE-2005-4677?
CVE-2005-4677 affects osCommerce versions 1.1 through 1.13.
4
Can CVE-2005-4677 lead to data breaches?
Yes, CVE-2005-4677 can potentially lead to data breaches as attackers can execute arbitrary SQL commands.
5
Is CVE-2005-4677 still relevant today?
While CVE-2005-4677 pertains to older osCommerce versions, it is still relevant for legacy systems that are not updated.