Security readout for executives and security teams
Plain-English summary
This CVE describes a possible XSS issue in the osCommerce Online Merchant 3.0.2 installer. If the installation page is reachable, attacker-supplied text in the name parameter may be reflected in an error message as script or HTML. The CVE itself questions practical impact because installer access may already imply administrator-level control.
Executive priority
Treat as a targeted legacy exposure check, not an emergency, unless an installer is publicly reachable. The business risk is mainly from forgotten setup paths on old osCommerce deployments.
Technical view
The reported flaw is improper handling of the name parameter in osCommerce/OM/Core/Site/Setup/Application/Install/RPC/DBCheck.php via oscommerce/index.php during installation. It may allow reflected script or HTML injection in an error response. No CVSS, CWE, confirmed patch, or exploitation evidence is provided in the supplied sources.
Likely exposure
Exposure appears limited to OSCommerce Online Merchant 3.0.2 systems where the installation workflow, especially oscommerce/index.php and the setup DBCheck RPC path, is reachable. Production systems with setup files removed or inaccessible are less likely to be exposed based on the provided description.
Exploitation context
The source bundle does not show KEV listing or active exploitation. The CVE describes remote injection only when the software is being installed. It also notes this may not be a vulnerability if installer access already requires administrator privileges.
Researcher notes
Evidence is sparse: one advisory reference and CVE metadata. Preserve the CVE caveat about administrator context. Avoid assuming exploitability beyond reflected XSS during installation, and do not infer affected versions beyond OSCommerce Online Merchant 3.0.2.
Mitigation direction
- Check osCommerce and Trustwave guidance for any vendor-supported remediation.
- Do not expose installation or setup interfaces on production systems.
- Remove or restrict installer components after deployment where operationally safe.
- If still using 3.0.2, plan migration or upgrade per vendor guidance.
Validation and detection
- Inventory internet-facing osCommerce installations and identify any version 3.0.2 instances.
- Verify setup or installation paths are not reachable without authorization.
- Review server logs for unexpected access to oscommerce/index.php during or after installation.
- Confirm no compensating controls depend on untrusted installer input handling.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2012-1792 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.trustwave.com/spiderlabs/advisories/TWSL2012-005.txtCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.