CVE-2012-0974 in osclass
Summary
by MITRE
Multiple cross-site scripting (XSS) vulnerabilities in the getParam function in oc-includes/osclass/core/Params.php in OSClass before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via the (1) sCity, (2) sPattern, (3) sPriceMax, and (4) sPriceMin parameters in a search action to index.php.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 02/08/2025
The vulnerability identified as CVE-2012-0974 represents a critical cross-site scripting weakness in the OSClass content management system that affects versions prior to 2.3.5. This flaw resides within the getParam function located in the oc-includes/osclass/core/Params.php file, which serves as a core component for handling user input parameters. The vulnerability specifically impacts the search functionality of the platform, making it susceptible to malicious injection attacks that can compromise user sessions and data integrity. The affected parameters sCity, sPattern, sPriceMax, and sPriceMin all share the same vulnerability, indicating a systemic flaw in how these input values are processed and sanitized before being rendered back to users.
The technical exploitation of this vulnerability occurs when remote attackers craft malicious payloads targeting the search endpoint at index.php. These attackers can inject arbitrary web scripts or HTML content through the vulnerable parameters, which are then executed in the context of other users' browsers. The flaw essentially allows attackers to bypass input validation mechanisms that should prevent malicious code from being stored or executed within the application. This type of vulnerability falls under CWE-79 which specifically addresses cross-site scripting in software applications, and aligns with ATT&CK technique T1566.001 for initial access through spearphishing attachments or links. The vulnerability demonstrates a classic lack of proper output encoding and input sanitization that is fundamental to preventing XSS attacks.
The operational impact of this vulnerability extends beyond simple data theft or defacement, as it can enable more sophisticated attacks such as session hijacking, credential theft, and the redirection of users to malicious websites. When users perform searches on an affected OSClass installation, any injected malicious code becomes part of the search results page, potentially affecting all visitors to that page. This creates a persistent threat vector where compromised installations can serve as command and control centers for distributing malware or conducting phishing campaigns. The vulnerability affects the core search functionality, making it particularly dangerous since search operations are frequently used and generate high traffic. Organizations using affected versions of OSClass face significant risk of user data compromise, reputational damage, and potential regulatory violations due to the exposure of sensitive user information through these XSS vectors.
Mitigation strategies for CVE-2012-0974 require immediate action to upgrade to OSClass version 2.3.5 or later, which contains the necessary patches to address the input validation flaws. Organizations should also implement additional security measures including input sanitization at multiple layers, output encoding of all user-supplied data, and the implementation of Content Security Policies to limit the execution of unauthorized scripts. Web application firewalls can provide additional protection by filtering suspicious requests before they reach the vulnerable application components. Regular security audits and penetration testing should be conducted to identify similar vulnerabilities in other application components, as the presence of one XSS vulnerability often indicates potential for similar issues throughout the codebase. The vulnerability highlights the importance of following secure coding practices and implementing comprehensive input validation mechanisms as recommended by OWASP Top Ten and NIST cybersecurity guidelines.