VYPR
← All advisories
High severity7.2NVD Advisory· Published Aug 22, 2019· Updated Jun 17, 2026

CVE-2018-18572

CVE-2018-18572

Description

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Because of this filter, script files with certain PHP-related extensions (such as .phtml and .php5) didn't execute in the application. But this filter didn't prevent the '.pht' extension. Thus, remote authenticated administrators can upload '.pht' files for arbitrary PHP code execution via a /catalog/admin/categories.php?cPath=&action=new_product URI.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • OsCommerce/Oscommerce2 versions
    cpe:2.3:a:oscommerce:oscommerce:2.3.4.1:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:oscommerce:oscommerce:2.3.4.1:*:*:*:*:*:*:*
    • (no CPE)range: = 2.3.4.1
  • osCommerce/osCommercedescription

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.