Summary
Online Merchant module for osCommerce is prone to a remote arbitrary-file- upload vulnerability because it fails to sufficiently sanitize user- supplied input.
Attackers can exploit this issue to upload arbitrary code and run it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation
other attacks are
also possible.
Online Merchant 2.2 is vulnerable
other versions may also be
affected.
Solution
Delete the file 'file_manager.php' in your 'admin' directory.
References
Updated on 2015-03-25
