CVE-2018-25114: osCommerce 2.3.4.1 Installer Unauthenticated Configuration File Injection PHP Code Execution
A remote code execution vulnerability exists within osCommerce Online Merchant version 2.3.4.1 due to insecure default configuration and missing authentication in the installer workflow. By default, the /install/ directory remains accessible after installation. An unauthenticated attacker can invoke install4.php, submit crafted POST data, and inject arbitrary PHP code into the configure.php file. When the application later includes this file, the injected payload is executed, resulting in full server-side compromise.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-25114?
CVE-2018-25114 has a high severity rating due to the potential for remote code execution.
How do I fix CVE-2018-25114?
To fix CVE-2018-25114, ensure the /install/ directory is removed or secured after installation and implement proper authentication controls.
What software is affected by CVE-2018-25114?
CVE-2018-25114 affects osCommerce Online Merchant version 2.3.4.1.
What is the cause of CVE-2018-25114?
CVE-2018-25114 is caused by an insecure default configuration and missing authentication in the installer workflow.
Can CVE-2018-25114 be exploited remotely?
Yes, CVE-2018-25114 can be exploited remotely by unauthenticated users if the installer directory is accessible.