CVE-2018-18573

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page

published August 22, 2019

CVSS
—
EPSS
3%
Percentile
85.3
In the wild
Unconfirmed
What it is

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Remote authenticated administrators can upload new '.htaccess' files (e.g., omitting .php) and subsequently achieve arbitrary PHP code execution via a /catalog/admin/categories.php?cPath=&action=new_product URI.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02606 · 85.3th percentile
Published
2019-08-22T14:34Z
EPSS history
Timeline
  • 22 AUG 14:34Z
    osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page
    cvelistv5