Secunia

JeiAr has reported a vulnerability in osCommerce, which potentially can be exploited by malicious people to manipulate data through HTTP.

The problem is that the "country" parameter isn't properly validated in various scripts including "create_account_process.php" and "account_edit_process.php". This can potentially be exploited to manipulate SQL queries.

Also the "products_id" isn't properly validated when a user adds an item to the shopping cart.

osCommerce 2.2ms1 has been reported vulnerable.

Solution
Reportedly, osCommerce 2.2ms2 isn't vulnerable.
Further details available in Customer Area

Provided and/or discovered by
JeiAr

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area