You can do it with OSCommerce, but you need to be very careful regarding how you set things up. Make sure that your OSCommerce configuration never touches, tastes, feels or smells any card holder data and only hand things off to a
PCI DSS Compliant Internet Payment Processing Service Provider(pdf).