Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

OSClass before 2.3.5 lets attackers run database commands

CVE-2012-0973 · published 14 years ago
Summary

Versions of the OSClass classifieds software older than 2.3.5 accept a search value that is not properly checked, allowing someone on the internet to insert their own database commands. This could let an attacker view, change or delete the information stored by the site. Upgrade to OSClass 2.3.5 or later (or apply the official security patch) to stop the problem.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
osclass osclass <= 2.3.4
cpe:2.3:a:osclass:osclass:*:*:*:*:*:*:*:*
Original advisory text
Multiple SQL injection vulnerabilities in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the sCategory parameter to index.php, which is not properly handled by th...
Multiple SQL injection vulnerabilities in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the sCategory parameter to index.php, which is not properly handled by the (1) osc_search_category_id function in oc-includes/osclass/helpers/hSearch.php and (2) findBySlug function oc-includes/osclass/model/Category.php. NOTE: some of these details are obtained from third party information.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
2% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published25 Sep 2012
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2012-0973 · NVD
Track software like this
Free during beta