CVE-2018-18966

Name of the Vulnerable Software and Affected Versions osCommerce version 2.3.4.1

Description The issue concerns an incomplete '.htaccess' file for blacklist filtering in the product page of osCommerce. Specifically, the .htaccess file in the catalog/images/ directory bans the html extension, but Internet Explorer can render HTML elements in a .eml file.

Recommendations For osCommerce version 2.3.4.1, consider updating the .htaccess file in the catalog/images/ directory to properly handle .eml files and prevent the rendering of HTML elements within them. As a temporary workaround, restrict access to the catalog/images/ directory to minimize the risk of exploitation.