Description
SQL injection vulnerability in additional_images.php (aka the Additional Images module) before 1.14 in osCommerce allows remote attackers to execute arbitrary SQL commands via the products_id parameter to product_info.php.
References
- 19874 vdb-entry
- 17082 third-party-advisory
- 15023 vdb-entry
- ADV-2005-1974 vdb-entry
- 20051006 OScommerce: "Additional Images" Module SQL Injection mailing-list
- http://www.oscommerce.com/community/contributions%2C1032
- oscommerce-productinfo-sql-injection(22528) vdb-entry