Vulnerability in Oscommerce Online Merchant

CVE-2012-2991

The PayPal (aka MODULE_PAYMENT_PAYPAL_STANDARD) module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self.

EPSS: 0.011 (63.3th percentile) — read the EPSS interpretation.

Affected products

Oscommerce Online_merchant — versions 2.3.0, 2.3.1, 2.3.2
Paypal Website_payments_standard_module
N/a — versions n/a

References

cret@cert.org (US Government Resource, x_refsource_CERT-VN, third-party-advisory)
cret@cert.org (x_refsource_SECUNIA, third-party-advisory)