CVE-2004-0300: SQL injection vulnerability in Online Store Kit 3.0 allows remote attackers to inject arbitrary SQL and gai...

Security readout for executives and security teams

CVE-2004-0300 is a SQL injection issue in Online Store Kit 3.0. Public shopping pages may pass unsafe user input into database queries, allowing a remote attacker to alter queries and potentially gain unauthorized access. The supplied sources do not identify a vendor patch or current active exploitation. Exposure is limited to organizations still running Online Store Kit 3.0, especially internet-facing stores exposing the named PHP files. This appears to be legacy software, so finding it may require source, web-root, and asset inventory checks rather than relying on modern package scanners. Treat as high priority if the product is present on an internet-facing store. SQL injection can expose customer, order, or admin data. If the product is absent, no action is needed beyond documenting the inventory result. Mitigation focus: Identify any Online Store Kit 3.0 deployments and affected PHP files.; Check vendor and advisory archives for an official update or migration guidance.; Retire or replace the application if it is unsupported..

Prepared

Jun 30, 2026, 06:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.