VYPR
← All advisories
High severity7.2NVD Advisory· Published Aug 22, 2019· Updated Jun 17, 2026

CVE-2018-18573

CVE-2018-18573

Description

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Remote authenticated administrators can upload new '.htaccess' files (e.g., omitting .php) and subsequently achieve arbitrary PHP code execution via a /catalog/admin/categories.php?cPath=&action=new_product URI.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • OsCommerce/Oscommerce2 versions
    cpe:2.3:a:oscommerce:oscommerce:2.3.4.1:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:oscommerce:oscommerce:2.3.4.1:*:*:*:*:*:*:*
    • (no CPE)range: = 2.3.4.1
  • osCommerce/osCommercedescription

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.