Unscored severity · published Sep 22, 2008
CVE-2008-4170
create_account.php in osCommerce 2.2 RC 2a allows remote attackers to obtain sensitive information via an invalid dob parameter, which reveals the installation path in an error…
–
CVSS
1.6%
EPSS
No
On KEV
Description
create_account.php in osCommerce 2.2 RC 2a allows remote attackers to obtain sensitive information via an invalid dob parameter, which reveals the installation path in an error message.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OS
Oscommerce · Oscommerce
2.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-4170
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-4170
securityreason.com
http://securityreason.com/securityalert/4293
www.securityfocus.com
http://www.securityfocus.com/archive/1/496417/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/31209
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/45193
More from Oscommerce
9.8
CVE-2023-6579
A vulnerability, which was classified as critical, has been found in osCommerce 4
9.8
CVE-2020-23360
oscommerce v2.3.4.1 has a functional problem in user registration and password rechecking, where a non-identical password can bypass the checks in…
9.8
CVE-2020-27976
osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely
9.3
CVE-2009-20006
osCommerce <= 2.2 Admin File Manager Arbitrary PHP Code Execution
8.8
CVE-2020-27975
osCommerce Phoenix CE before 1.0.5.4 allows admin/define_language.php CSRF