Description

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Remote authenticated administrators can upload new '.htaccess' files (e.g., omitting .php) and subsequently achieve arbitrary PHP code execution via a /catalog/admin/categories.php?cPath=&action=new_product URI.

Remediation

References

CVE-2018-18573

Related Vulnerabilities

WordPress Plugin Social Sharing-Social Warfare Cross-Site Scripting (3.5.3)

PHP CVE-2014-3515 Vulnerability (CVE-2014-3515)

MySQL CVE-2016-5633 Vulnerability (CVE-2016-5633)

Oracle Database Server Improper Authentication Vulnerability (CVE-2012-3137)

MySQL CVE-2013-2395 Vulnerability (CVE-2013-2395)

Severity

High

Classification

CVE-2018-18573 CWE-94 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities