Vulnerability-Lookup

GHSA-PV4C-FQ9M-45GM

Vulnerability from github – Published: 2022-05-24 16:54 – Updated: 2024-04-04 01:46

Details

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Because of this filter, script files with certain PHP-related extensions (such as .phtml and .php5) didn't execute in the application. But this filter didn't prevent the '.pht' extension. Thus, remote authenticated administrators can upload '.pht' files for arbitrary PHP code execution via a /catalog/admin/categories.php?cPath=&action=new_product URI.

Severity

7.2 (High)


                  
                    CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2018-18572"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-08-22T15:15:00Z",
    "severity": "HIGH"
  },
  "details": "osCommerce 2.3.4.1 has an incomplete \u0027.htaccess\u0027 for blacklist filtering in the \"product\" page. Because of this filter, script files with certain PHP-related extensions (such as .phtml and .php5) didn\u0027t execute in the application. But this filter didn\u0027t prevent the \u0027.pht\u0027 extension. Thus, remote authenticated administrators can upload \u0027.pht\u0027 files for arbitrary PHP code execution via a /catalog/admin/categories.php?cPath=\u0026action=new_product URI.",
  "id": "GHSA-pv4c-fq9m-45gm",
  "modified": "2024-04-04T01:46:04Z",
  "published": "2022-05-24T16:54:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18572"
    },
    {
      "type": "WEB",
      "url": "https://github.com/osCommerce/oscommerce2/issues/631"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2018-18572 (GCVE-0-2018-18572)

Vulnerability from cvelistv5 – Published: 2019-08-22 14:33 – Updated: 2024-08-05 11:15

Summary

Severity

No CVSS data available.

CWE

Assigner

mitre

References

1 reference

URL	Tags
https://github.com/osCommerce/oscommerce2/issues/631	x_refsource_CONFIRM

Date Public

2018-11-05 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T11:15:59.943Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/osCommerce/oscommerce2/issues/631"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-11-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "osCommerce 2.3.4.1 has an incomplete \u0027.htaccess\u0027 for blacklist filtering in the \"product\" page. Because of this filter, script files with certain PHP-related extensions (such as .phtml and .php5) didn\u0027t execute in the application. But this filter didn\u0027t prevent the \u0027.pht\u0027 extension. Thus, remote authenticated administrators can upload \u0027.pht\u0027 files for arbitrary PHP code execution via a /catalog/admin/categories.php?cPath=\u0026action=new_product URI."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-08-22T14:33:07.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/osCommerce/oscommerce2/issues/631"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-18572",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "osCommerce 2.3.4.1 has an incomplete \u0027.htaccess\u0027 for blacklist filtering in the \"product\" page. Because of this filter, script files with certain PHP-related extensions (such as .phtml and .php5) didn\u0027t execute in the application. But this filter didn\u0027t prevent the \u0027.pht\u0027 extension. Thus, remote authenticated administrators can upload \u0027.pht\u0027 files for arbitrary PHP code execution via a /catalog/admin/categories.php?cPath=\u0026action=new_product URI."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/osCommerce/oscommerce2/issues/631",
              "refsource": "CONFIRM",
              "url": "https://github.com/osCommerce/oscommerce2/issues/631"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-18572",
    "datePublished": "2019-08-22T14:33:07.000Z",
    "dateReserved": "2018-10-22T00:00:00.000Z",
    "dateUpdated": "2024-08-05T11:15:59.943Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-PV4C-FQ9M-45GM

CVE-2018-18572 (GCVE-0-2018-18572)

Tags

Sightings

Nomenclature