CVE-2018-25397

PHP-SHOP 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to add administrative users by crafting malicious HTML forms. Attackers can trick authenticated administrators into visiting a page containing a hidden form that automatically submits POST requests to the users.php endpoint with parameters like name, email, password, and permissions set to admin to create unauthorized admin accounts.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/joeyrush/PHP-SHOP/archive/master.zip
https://www.exploit-db.com/exploits/45636
https://www.vulncheck.com/advisories/php-shop-cross-site-request-forgery-via-users-php

Configurations

No configuration.

History

21 Jul 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) PHP-SHOP 1.0 contiene una vulnerabilidad de falsificación de petición en sitios cruzados que permite a atacantes no autenticados añadir usuarios administrativos mediante la creación de formularios HTML maliciosos. Los atacantes pueden engañar a administradores autenticados para que visiten una página que contiene un formulario oculto que envía automáticamente peticiones POST al endpoint users.php con parámetros como nombre, correo electrónico, contraseña y permisos configurados como admin para crear cuentas de administrador no autorizadas.

29 May 2026, 16:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-05-29 16:16

Updated : 2026-07-21 15:10

NVD link : CVE-2018-25397

Mitre link : CVE-2018-25397

CVE.ORG link : CVE-2018-25397

JSON object : View

Products Affected

No product.

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2018-25397", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2018-25397", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-02T01:33:28.119294Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "joeyrush", "product": "PHP-SHOP master", "versions": [{"status": "affected", "version": "1.0"}]}]}], "published": "2026-05-29T16:16:19.237", "references": [{"url": "https://github.com/joeyrush/PHP-SHOP/archive/master.zip", "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/45636", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/php-shop-cross-site-request-forgery-via-users-php", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "PHP-SHOP 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to add administrative users by crafting malicious HTML forms. Attackers can trick authenticated administrators into visiting a page containing a hidden form that automatically submits POST requests to the users.php endpoint with parameters like name, email, password, and permissions set to admin to create unauthorized admin accounts."}, {"lang": "es", "value": "PHP-SHOP 1.0 contiene una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n en sitios cruzados que permite a atacantes no autenticados a\u00f1adir usuarios administrativos mediante la creaci\u00f3n de formularios HTML maliciosos. Los atacantes pueden enga\u00f1ar a administradores autenticados para que visiten una p\u00e1gina que contiene un formulario oculto que env\u00eda autom\u00e1ticamente peticiones POST al endpoint users.php con par\u00e1metros como nombre, correo electr\u00f3nico, contrase\u00f1a y permisos configurados como admin para crear cuentas de administrador no autorizadas."}], "lastModified": "2026-07-21T15:10:00.103", "sourceIdentifier": "disclosure@vulncheck.com"}