CVE-2018-25114
BaseFortify
Publication date: 2025-07-23
Last updated on: 2025-07-25
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oscommerce | online_merchant | 2.3.4.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a remote code execution issue in osCommerce Online Merchant version 2.3.4.1. It occurs because the /install/ directory remains accessible after installation without authentication. An attacker can access install_4.php, send specially crafted POST data, and inject arbitrary PHP code into the configure.php file. When the application later includes this file, the injected code executes, allowing the attacker to fully compromise the server.
How can this vulnerability impact me? :
The vulnerability can lead to full server-side compromise, meaning an attacker can execute arbitrary code on the server. This can result in unauthorized access, data theft, data manipulation, service disruption, and potentially complete control over the affected system.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately restrict or remove access to the /install/ directory after installation. Ensure that the installer workflow is not accessible to unauthenticated users. Remove or secure the install_4.php script to prevent arbitrary PHP code injection into configure.php. Applying these steps will prevent attackers from exploiting the insecure default configuration and missing authentication.