CVE-2007-1477: Oscommerce PHP Point Of Sale

High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days.

Directory traversal vulnerability in index.php in PHP Point Of Sale for osCommerce 1.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the cfg_language parameter. NOTE: this issue has been disputed by CVE, since the cfg_language variable is configured upon proper product installation

Affected products

• Oscommerce PHP Point Of Sale: version 1.1 only

Published 2007-03-16. Last modified 2026-06-16.