CVE-2012-1665 — Multiple SQL injection vulnerabilities in the admin panel in osCMax before 2.5.1 allow (1) remote attackers to execute arbitrary SQL commands via the username parameter in a process action to admin/login.php or (2) remote administrators to execute arbitrary SQL commands via the status parameter to admin/stats_monthly_sales.php or (3) country parameter in a process action to admin/create_account_process.php

Back Back to CVE browser

HIGH

Multiple SQL injection vulnerabilities in the admin panel in osCMax before 2.5.1 allow (1) remote attackers to execute arbitrary SQL commands via the username parameter in a process action to admin/login.php or (2) remote administrators to execute arbitrary SQL commands via the status parameter to admin/stats_monthly_sales.php or (3) country parameter in a process action to admin/create_account_process.php

Published May 20, 2015

7.5

HIGH

CVSS 2.0

EPSS 1.52%

Description

Multiple SQL injection vulnerabilities in the admin panel in osCMax before 2.5.1 allow (1) remote attackers to execute arbitrary SQL commands via the username parameter in a process action to admin/login.php or (2) remote administrators to execute arbitrary SQL commands via the status parameter to admin/stats_monthly_sales.php or (3) country parameter in a process action to admin/create_account_process.php.

Affected products

Remediation

No remediation recorded yet.

Metrics

1.52% 0.01520

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.01520

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (14 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	1.52% (0.01520)	73.65th	v5 (v2026.06.15)
Jun 15, 2026	1.55% (0.01550)	71.76th	v5 (v2026.06.15)
Apr 4, 2026	1.86% (0.01863)	83.02th	v4 (v2025.03.14)
Feb 2, 2026	0.80% (0.00799)	73.68th	v4 (v2025.03.14)
Mar 17, 2025	1.92% (0.01920)	82.13th	v4 (v2025.03.14)
Dec 12, 2024	0.30% (0.00297)	70.22th	v3 (v2023.03.01)
Feb 8, 2024	0.58% (0.00580)	77.38th	v3 (v2023.03.01)
Aug 20, 2023	0.58% (0.00580)	75.26th	v3 (v2023.03.01)
Mar 7, 2023	0.82% (0.00821)	79.26th	v3 (v2023.03.01)
Mar 6, 2023	1.41% (0.01406)	72.10th	v2 (v2022.01.01)
Mar 3, 2023	1.41% (0.01406)	72.09th	v2 (v2022.01.01)
Feb 23, 2023	1.81% (0.01806)	76.96th	v2 (v2022.01.01)
Apr 1, 2022	1.81% (0.01806)	74.92th	v2 (v2022.01.01)
Feb 4, 2022	1.81% (0.01806)	54.21th	v2 (v2022.01.01)

Weaknesses (1)

CWE-89

SQL Injection

References (7)

http://archives.neohapsis.com/archives/bugtraq/2012-04/0021.html
mailing-listx_refsource_BUGTRAQ
http://bugtrack.oscmax.com/view.php?id=1165
x_refsource_CONFIRM
http://www.oscmax.com/blog/michael_s/oscmax_v251_has_been_released_security_update
x_refsource_CONFIRM
http://www.osvdb.org/80900
vdb-entryx_refsource_OSVDB
http://www.osvdb.org/80901
vdb-entryx_refsource_OSVDB
http://www.osvdb.org/80902
vdb-entryx_refsource_OSVDB
https://www.htbridge.com/advisory/HTB23081
x_refsource_MISCExploit

Link	Providers	Tags
http://archives.neohapsis.com/archives/bugtraq/2012-04/0021.html		mailing-listx_refsource_BUGTRAQ
http://bugtrack.oscmax.com/view.php?id=1165		x_refsource_CONFIRM
http://www.oscmax.com/blog/michael_s/oscmax_v251_has_been_released_security_update		x_refsource_CONFIRM
http://www.osvdb.org/80900		vdb-entryx_refsource_OSVDB
http://www.osvdb.org/80901		vdb-entryx_refsource_OSVDB
http://www.osvdb.org/80902		vdb-entryx_refsource_OSVDB
https://www.htbridge.com/advisory/HTB23081		x_refsource_MISCExploit

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published May 20, 2015

Updated Aug 6, 2024

Reserved Mar 14, 2012

Link CVE-2012-1665

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 16, 2026

Link CVE-2012-1665

Red Hat

Severity n/a

Public date n/a

Links CVE-2012-1665