CVE-2004-0300

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2004-11-23 · updated 2026-06-16

Description

SQL injection vulnerability in Online Store Kit 3.0 allows remote attackers to inject arbitrary SQL and gain unauthorized access via (1) the cat parameter in shop.php, (2) the id parameter in more.php, (3) the cat_manufacturer parameter in shop_by_brand.php, or (4) the id parameter in listing.php.

Affected products

Ecommerce Corporation Online Store Kit: 3.0_lite, 3.0_pro, 3.0_standard

References

http://marc.info/?l=bugtraq&m=107712117913185&w=2
http://secunia.com/advisories/10902/
http://securitytracker.com/alerts/2004/Feb/1009092.html
http://www.osvdb.org/3973
http://www.securityfocus.com/bid/9676
http://www.securityfocus.com/bid/9687
http://www.systemsecure.org/advisories/ssadvisory16022004.php
http://www.zone-h.org/en/advisories/read/id=3972/
https://exchange.xforce.ibmcloud.com/vulnerabilities/15232
http://marc.info/?l=bugtraq&m=107712117913185&w=2
http://secunia.com/advisories/10902/
http://securitytracker.com/alerts/2004/Feb/1009092.html

Get alerted when CVE-2004-0300 or the next vulnerability affects your stack