CVE-2005-2330

CVE-2005-2330 describes a directory traversal vulnerability in osCommerce version 2.2, specifically within the extras/update.php script. This flaw allows unauthenticated remote attackers to read arbitrary files on the server by manipulating the readme_file parameter with ".." sequences or full pathnames. With a CVSS score of 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N), it indicates a network-exploitable vulnerability with low attack complexity, requiring no authentication, and primarily impacting confidentiality by allowing information disclosure. While not listed on the KEV catalog or Hot List, an exploit is publicly available on ExploitDB, though there is no evidence of widespread active exploitation, and community discussion and media coverage are minimal.