$ cve CVE-2004-0300 JSON

CVE-2004-0300 EXPLOIT

10.0

HIGH · CVSS 2.0 · EPSS 5.2% (pctl 92)

Patch early

A public exploit exists.

Description

SQL injection vulnerability in Online Store Kit 3.0 allows remote attackers to inject arbitrary SQL and gain unauthorized access via (1) the cat parameter in shop.php, (2) the id parameter in more.php, (3) the cat_manufacturer parameter in shop_by_brand.php, or (4) the id parameter in listing.php.

Scoring

CVSS	10.0 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS	5.17% — more likely to be exploited than 92% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2004-11-23
Last modified	2026-06-16

Affected (1)

Vendor	Product
ecommerce corporation online	store kit

Public exploits

Source	Title	Date
exploit-db	eCommerce Corporation Online Store Kit 3.0 - 'shop.php?cat' SQL Injection	2004-02-18
exploit-db	eCommerce Corporation Online Store Kit 3.0 - 'shop_by_brand.php?cat_manufacturer' SQL Injection	2004-02-18
exploit-db	eCommerce Corporation Online Store Kit 3.0 - 'listing.php?id' SQL Injection	2004-02-18
exploit-db	eCommerce Corporation Online Store Kit 3.0 - 'More.php?id' SQL Injection	2003-02-17

References

→ the Explorer · watch your stack · NVD