/prog/ - Security Advisories

Name: Anonymous 2012-09-20 5:21

ITT: We share 0day security vulnerabilities in public software.

Me first.

OsCommerce Newsletters & Subscribers Osc Addon (Download Link: http://addons.oscommerce.com/info/8540)
Vulnerable code:

newsletters_subscribe.php line 16:
$subscribers_info = tep_db_query("select subscribers_id from " . TABLE_SUBSCRIBERS . " where subscribers_email_address = '" . $HTTP_POST_VARS['Email'] . "' ");

There are various other points in the code where POST input is not sanitized allowing SQL injection.

Name: Anonymous 2012-09-20 5:48

the fact that nobody has done that yet and the fact that sanitizing input is so easy makes me wonder why the world is so retarded

Security Advisories

1 Name: Anonymous 2012-09-20 5:21

6 Name: Anonymous 2012-09-20 5:48

Name: Anonymous 2012-09-20 5:21

Name: Anonymous 2012-09-20 5:48