CVE-2018-18572

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Because of this filter, script files with certain PHP-related extensions (such as .phtml and .php5) didn't execute in the application. But this filter didn't prevent the '.pht' extension. Thus, remote authenticated administrators can upload '.pht' files for arbitrary PHP code execution via a /catalog/admin/categories.php?cPath=&action=new_product URI.

• CWE-434

• https://github.com/osCommerce/oscommerce2/issues/631Third Party Advisory
• https://github.com/osCommerce/oscommerce2/issues/631Third Party Advisory

Published

Aug 22, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-18567AudioCodes 440HD and 450HD devices 3.1.2.89 and earlier allo…
• CVE-2018-18568Polycom VVX 500 and 601 devices 5.8.0.12848 and earlier allo…5.9
• CVE-2018-18569The Dundas BI server before 5.0.1.1010 is vulnerable to a Se…
• CVE-2018-1857IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Se…4.8
• CVE-2018-18570Planon before Live Build 41 has XSS.
• CVE-2018-18571An Incorrect Access Control vulnerability has been identifie…9.1
• CVE-2018-18573osCommerce 2.3.4.1 has an incomplete '.htaccess' for blackli…
• CVE-2018-18576The Hustle (aka wordpress-popup) plugin through 6.0.5 for Wo…5.3
• CVE-2018-18578DedeCMS 5.7 SP2 allows XSS via the plus/qrcode.php type para…
• CVE-2018-18579Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/pm.p…
• CVE-2018-1858IBM API Connect 5.0.0.0 through 5.0.8.6 is vulnerable to cro…8.8
• CVE-2018-18581An issue has been found in LuPng through 2017-03-10. It is a…