Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Because of this filter, script files with certain PHP-related extensions (such as .phtml and .php5) didn't execute in the application. But this filter didn't prevent the '.pht' extension. Thus, remote authenticated administrators can upload '.pht' files for arbitrary PHP code execution via a /catalog/admin/categories.php?cPath=&action=new_product URI.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
osCommerce 代码问题漏洞
Vulnerability Description
osCommerce是一套基于GNUGPL授权的开源在线购物电子商务解决方案。 osCommerce 2.3.4.1版本中存在安全漏洞，该漏洞源于‘product’页面中使用了不完整的‘.htaccess’文件来进行黑名单过滤。远程攻击者可借助/catalog/admin/categories.php?cPath=&action=new_product URI利用该漏洞上传‘.pht’文件并执行任意代码。
CVSS Information
N/A
Vulnerability Type
N/A