Quick answers
- Is CVE-2018-25337 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2018-25337 being exploited in the wild.
- How severe is CVE-2018-25337?
- Medium severity, with a CVSS score of 4.3, published 17 May 2026.
- Which products and versions are affected?
- Joomla! JoomOCShop 1.0.
- Is there a fix for CVE-2018-25337?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2018-25337 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2018-25337?
- Check whether you run Joomla! JoomOCShop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Joomla JoomOCShop 1.0 extension due to a lack of unique, unpredictable tokens in state-changing requests. An attacker can exploit this by crafting malicious HTML forms that target account management endpoints such as /joomoc2/?route=account/edit or /jcart/account/password.html. If an authenticated user visits a malicious site or clicks a specially crafted link, the attacker can silently submit these forms to modify the user's profile information or reset their password. This vulnerability requires the victim to be authenticated and have an active session with the vulnerable application. No official patch has been identified, as the vendor's site and extension page are currently inactive.
Affected products
- Joomla! extension JoomOCShop 1.0
Timeline
- 2018-05-28: disclosed: Initial exploit published on Exploit-DB
- 2026-05-17: advisory: CVE published and NVD record created