CVE-2011-4543

osCommerce 3.0.2 sürümündeki birden fazla dizin gezginliği (directory traversal) zafiyeti, uzaktan saldırganların şunlar aracılığıyla rastgele yerel dosyaları dahil etmesine ve çalıştırmasına olanak tanır: (1) set veya (2) module parametresindeki .. (nokta nokta) kullanımı ile (a) OM/Core/Site/Admin/Application/templates_modules/pages/info.php, (b) OM/Core/Site/Admin/Application/templates_modules/pages/edit.php veya (c) OM/Core/Site/Admin/Application/templates_modules/pages/uninstall.php; (3) set parametresi ile OM/Core/Site/Admin/Application/templates_modules/pages/main.php; module parametresi ile (4) OM/Core/Site/Admin/Application/modules_order_total/pages/edit.php, (5) OM/Core/Site/Admin/Application/modules_order_total/pages/uninstall.php, (6) OM/Core/Site/Admin/Application/modules_order_total/pages/info.php, (7) OM/Core/Site/Admin/Application/modules_geoip/pages/edit.php, (8) OM/Core/Site/Admin/Application/modules_geoip/pages/uninstall.php, (9) OM/Core/Site/Admin/Application/images/pages/main.php, (10) OM/Core/Site/Admin/Application/modules_shipping/pages/edit.php veya (11) OM/Core/Site/Admin/Application/modules_shipping/pages/uninstall.php; filter parametresi ile (12) OM/Core/Site/Admin/Application/templates_modules_layout/pages/main.php, (13) OM/Core/Site/Admin/Application/templates_modules_layout/pages/new.php veya (14) OM/Core/Site/Admin/Application/templates_modules_layout/pages/edit.php; veya template parametresi ile (15) OM/Core/Site/Admin/Application/templates/pages/info.php, (16) OM/Core/Site/Admin/Application/templates/pages/edit.php veya (17) OM/Core/Site/Admin/Application/templates/pages/uninstall.php.