CVE-2012-6691

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2015-05-20 · updated 2026-06-16
Weakness: CWE-352

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in the admin panel in osCMax before 2.5.1 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the (1) status parameter to admin/stats_monthly_sales.php or (2) country parameter in a process action to admin/create_account_process.php.

Affected products

Oscmax: through 2.5.0

References

http://archives.neohapsis.com/archives/bugtraq/2012-04/0021.html
http://www.oscmax.com/blog/michael_s/oscmax_v251_has_been_released_security_update
http://www.securityfocus.com/bid/74753
https://www.htbridge.com/advisory/HTB23081
http://archives.neohapsis.com/archives/bugtraq/2012-04/0021.html
http://www.oscmax.com/blog/michael_s/oscmax_v251_has_been_released_security_update
http://www.securityfocus.com/bid/74753
https://www.htbridge.com/advisory/HTB23081

Get alerted when CVE-2012-6691 or the next vulnerability affects your stack