CVE-2018-18966: Medium severity oscommerce php point of sale vulnerability

Published Nov 6, 2018

Updated

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. The .htaccess file in catalog/images/ bans the html extension, but Internet Explorer render HTML elements in a .eml file.

Affected Software

2 affected components

osCommerce Online Merchant=2.3.4.1

Microsoft Internet Explorer

Event History

Nov 6, 2018

CVE Published

via MITRE·04:00 AM

Data Sourced

via MITRE·04:00 AM

Description

Frequently Asked Questions

What is the vulnerability ID for osCommerce 2.3.4.1?

The vulnerability ID for osCommerce 2.3.4.1 is CVE-2018-18966.

What is the severity level of CVE-2018-18966?

The severity level of CVE-2018-18966 is medium with a value of 4.9.

How does osCommerce 2.3.4.1 have an incomplete .htaccess file?

osCommerce 2.3.4.1 has an incomplete .htaccess file for blacklist filtering in the 'product' page. The .htaccess file in catalog/images/ bans the html extension, but Internet Explorer renders HTML elements in a .eml file.

What software versions are affected by CVE-2018-18966?

osCommerce 2.3.4.1 is affected by CVE-2018-18966.

Is Microsoft Internet Explorer vulnerable to CVE-2018-18966?

No, Microsoft Internet Explorer is not vulnerable to CVE-2018-18966.

Where can I find more information about CVE-2018-18966?

You can find more information about CVE-2018-18966 at the following link: [https://github.com/osCommerce/oscommerce2/issues/631](https://github.com/osCommerce/oscommerce2/issues/631)