Vulnerability Description
PHP-SHOP 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to add administrative users by crafting malicious HTML forms. Attackers can trick authenticated administrators into visiting a page containing a hidden form that automatically submits POST requests to the users.php endpoint with parameters like name, email, password, and permissions set to admin to create unauthorized admin accounts.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/joeyrush/PHP-SHOP/archive/master.zip
- https://www.exploit-db.com/exploits/45636
- https://www.vulncheck.com/advisories/php-shop-cross-site-request-forgery-via-use
FAQ
What is CVE-2018-25397?
CVE-2018-25397 is a vulnerability with a CVSS score of 5.3 (MEDIUM). PHP-SHOP 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to add administrative users by crafting malicious HTML forms. Attackers can trick authenticated a...
How severe is CVE-2018-25397?
CVE-2018-25397 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-25397?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.