Description

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Remote authenticated administrators can upload new '.htaccess' files (e.g., omitting .php) and subsequently achieve arbitrary PHP code execution via a /catalog/admin/categories.php?cPath=&action=new_product URI.

Remediation

References

CVE-2018-18573

Related Vulnerabilities

WordPress Plugin Shortcode for Font Awesome Cross-Site Scripting (1.4)

WordPress Plugin BA Book Everything Cross-Site Scripting (1.3.24)

Drupal Core 8.5.0 Remote Code Execution (8.5.0)

Apache Tomcat Permissions, Privileges, and Access Controls Vulnerability (CVE-2011-3376)

WordPress Plugin wp-championship SQL Injection (5.8)

Severity

High

Classification

CVE-2018-18573 CWE-94 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities