CVE-2012-0865

Severity: medium (CVSS 5.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2012-02-21 · updated 2026-06-16
Weakness: CWE-20

Description

Multiple open redirect vulnerabilities in CubeCart 3.0.20 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) r parameter to switch.php or (2) goto parameter to admin/login.php.

Affected products

CubeCart Limited CubeCart: through 3.0.20; 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5 (+14)

References

http://archives.neohapsis.com/archives/bugtraq/2012-02/0058.html
http://osvdb.org/79140
http://osvdb.org/79141
http://www.openwall.com/lists/oss-security/2012/02/12/4
http://www.openwall.com/lists/oss-security/2012/02/13/5
http://www.openwall.com/lists/oss-security/2012/02/18/1
http://www.securityfocus.com/bid/51966
http://www.securitytracker.com/id?1026711
http://yehg.net/lab/pr0js/advisories/%5Bcubecart_3.0.20_3.0.x%5D_open_url_redirection
http://archives.neohapsis.com/archives/bugtraq/2012-02/0058.html
http://osvdb.org/79140
http://osvdb.org/79141

Get alerted when CVE-2012-0865 or the next vulnerability affects your stack