CVE-2018-18572

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Because of this filter, script files with certain PHP-related extensions such as .phtml and .php5 didn't execute in the application. But this filter didn't prevent the '.pht' extension. Thus, remote...

Code injection

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Remote authenticated administrators can upload new '.htaccess' files e.g., omitting .php and subsequently achieve arbitrary PHP code execution via a /catalog/admin/categories.php?cPath=&action=newprodu...

Code injection

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Because of this filter, script files with certain PHP-related extensions such as .phtml and .php5 didn't execute in the application. But this filter didn't prevent the '.pht' extension. Thus, remote...

CVE-2018-18573

CVE-2018-18573 affects osCommerce 2.3.4.1. The issue is an incomplete an access control/blacklist mechanism in the product page’s .htaccess filtering. Remote authenticated administrators can upload new .htaccess files (for example omitting .php) and thereby achieve arbitrary PHP code execution vi...

CVE-2018-18573

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Remote authenticated administrators can upload new '.htaccess' files e.g., omitting .php and subsequently achieve arbitrary PHP code execution via a /catalog/admin/categories.php?cPath=&action=newprodu...

CVE-2018-18573

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Remote authenticated administrators can upload new '.htaccess' files e.g., omitting .php and subsequently achieve arbitrary PHP code execution via a /catalog/admin/categories.php?cPath=&action=newprodu...

CVE-2018-18572

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Because of this filter, script files with certain PHP-related extensions such as .phtml and .php5 didn't execute in the application. But this filter didn't prevent the '.pht' extension. Thus, remote...

CVE-2018-18572

Summary: CVE-2018-18572 affects osCommerce 2.3.4.1. An incomplete blacklist in the .htaccess on the product page allows remote authenticated administrators to upload files with the .pht extension, bypassing the filter and enabling arbitrary PHP code execution via /catalog/admin/categories.php?cPa...

CVE-2018-18572

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Because of this filter, script files with certain PHP-related extensions such as .phtml and .php5 didn't execute in the application. But this filter didn't prevent the '.pht' extension. Thus, remote...

CVE-2018-18573: Improper Control of Generation of Code

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Remote authenticated administrators can upload new '.htaccess' files e.g., omitting .php and subsequently achieve arbitrary PHP code execution via a /catalog/admin/categories.php?cPath=&action=newprodu...

PT-2019-9608

Name of the Vulnerable Software and Affected Versions osCommerce version 2.3.4.1 Description The issue is related to an incomplete '.htaccess' file for blacklist filtering in the product page, allowing remote authenticated administrators to upload new '.htaccess' files. This can lead to arbitrary...

CVE-2018-18572: Unrestricted Upload of File with Dangerous Type

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Because of this filter, script files with certain PHP-related extensions such as .phtml and .php5 didn't execute in the application. But this filter didn't prevent the '.pht' extension. Thus, remote...

PT-2019-9607

Name of the Vulnerable Software and Affected Versions osCommerce version 2.3.4.1 Description The issue arises from an incomplete '.htaccess' file for blacklist filtering on the product page, which fails to prevent the execution of files with the '.pht' extension. This allows remote authenticated...

osCommerce 2.3.4.1 - currency SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: osCommerce 2.3.4.1 - 'currency' SQL Vulnerabilities Exploit Author: Mehmet EMIROGLU Vendor Homepage: https://www.oscommerce.com Software Link: https://www.oscommerce.com/Products Version: 2.3.4.1 Category: Webapps Tested on: Wam...

osCommerce 2.3.4.1 - reviews_id SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: osCommerce 2.3.4.1 - 'reviewsid' SQL Vulnerabilities Exploit Author: Mehmet EMIROGLU Vendor Homepage: https://www.oscommerce.com Software Link: https://www.oscommerce.com/Products Version: 2.3.4.1 Category: Webapps Tested on:...

osCommerce 2.3.4.1 - products_id SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: osCommerce 2.3.4.1 - 'productsid' SQL Vulnerabilities Exploit Author: Mehmet EMIROGLU Vendor Homepage: https://www.oscommerce.com Software Link: https://www.oscommerce.com/Products Version: 2.3.4.1 Category: Webapps Tested on:...

osCommerce 2.3.4.1 SQL Injection

Exploit Title: osCommerce 2.3.4.1 - 'currency' SQL Vulnerabilities Dork: N/A Date: 05-02-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage: https://www.oscommerce.com Software Link: https://www.oscommerce.com/Products Version: 2.3.4.1 Category: Webapps Tested on: Wampp @Win CVE: N/A Software...

osCommerce 2.3.4.1 - products_id SQL Injection

osCommerce 2.3.4.1 - productsid SQL Injection Exploit Title: osCommerce 2.3.4.1 - 'productsid' SQL Vulnerabilities Dork: N/A Date: 05-02-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage: https://www.oscommerce.com Software Link: https://www.oscommerce.com/Products Version: 2.3.4.1 Category:...

osCommerce 2.3.4.1 - reviews_id SQL Injection

osCommerce 2.3.4.1 - reviewsid SQL Injection Exploit Title: osCommerce 2.3.4.1 - 'reviewsid' SQL Vulnerabilities Dork: N/A Date: 05-02-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage: https://www.oscommerce.com Software Link: https://www.oscommerce.com/Products Version: 2.3.4.1 Category:...

osCommerce 2.3.4.1 - currency SQL Injection

osCommerce 2.3.4.1 - currency SQL Injection Exploit Title: osCommerce 2.3.4.1 - 'currency' SQL Vulnerabilities Dork: N/A Date: 05-02-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage: https://www.oscommerce.com Software Link: https://www.oscommerce.com/Products Version: 2.3.4.1 Category: Webap...