Unscored CVE-2007-1477 EUVD-2007-1471GHSA-3qgg-q55f-9qv8

Directory traversal vulnerability in index.php in PHP Point Of Sale for osCommerce 1.1 allows remote attackers to include and execute arbit…

Published Mar 16, 2007 · Updated Aug 7, 2024 · Assigned by mitre

Description

Directory traversal vulnerability in index.php in PHP Point Of Sale for osCommerce 1.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the cfg_language parameter. NOTE: this issue has been disputed by CVE, since the cfg_language variable is configured upon proper product installation

References

20070312 PHP Point Of Sale for osCommerce <= (index.php) Remote File Include Vuln mailing-list
pos-index-file-include(33006) vdb-entry
2426 third-party-advisory
20070427 FALSE -> PHP Point of Sale (osCommerce) LFI mailing-list