CVE-2018-18572
Because of this filter, script files with certain PHP-related extensions (such as .phtml and .php5) didn't execute in the application.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.54%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Because of this filter, script files with certain PHP-related extensions (such as .phtml and .php5) didn't execute in the application. But this filter didn't prevent the '.pht' extension. Thus, remote authenticated administrators can upload '.pht' files for arbitrary PHP code execution via a /catalog/admin/categories.php?cPath=&action=new_product URI.
- CVSS 3.0
- 7.2 HIGHCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 2.54% probability · 84th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-434
- Affected
- oscommerce/oscommerce
- Source
- cve@mitre.org
References
- https://github.com/osCommerce/oscommerce2/issues/631Third Party Advisory
- https://github.com/osCommerce/oscommerce2/issues/631Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.