VYPR
← All advisories
Unrated severityNVD Advisory· Published May 20, 2015· Updated Jun 16, 2026

CVE-2012-6691

CVE-2012-6691

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in the admin panel in osCMax before 2.5.1 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the (1) status parameter to admin/stats_monthly_sales.php or (2) country parameter in a process action to admin/create_account_process.php.

Affected products

2
  • Oscmax/Oscmax2 versions
    cpe:2.3:a:oscmax:oscmax:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:oscmax:oscmax:*:*:*:*:*:*:*:*range: <=2.5.0
    • (no CPE)range: <2.5.1

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.