If the “extras” folder is placed inside the webroot on osCommerce versions less than v2.2 any file can be read on the target system, including php source code with the database details.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/45499/osCommerce-2.2-extras.txt
Source: https://packetstormsecurity.com/files/45499/osCommerce-2.2-extras.txt.html