# CVE-2018-25343: Smakosh Smartshop CSRF in editprofile.php

Source: https://junglewise.ai/threats/cve-2018-25343-smakosh-smartshop-csrf-in-editprofile-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-23. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2018-25343 · Severity: medium · CVSS 4.3 · Published 2026-05-23

Smartshop, an e-commerce website platform, is vulnerable to a security flaw that allows unauthorized changes to user accounts. By tricking a logged-in administrator into visiting a malicious webpage, an attacker can silently change the administrator's email address and password. This could lead to a full takeover of the administrative account and the e-commerce site.

Technologies: [Smakosh Smartshop](https://junglewise.ai/threats/technologies/smartshop). Vendors: [Smakosh](https://junglewise.ai/threats/vendors/smakosh).

## Quick answers

**Is CVE-2018-25343 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2018-25343 being exploited in the wild.

**How severe is CVE-2018-25343?** Medium severity, with a CVSS score of 4.3, published 23 May 2026.

**Which products and versions are affected?** Smakosh Smartshop 1.0 and earlier.

**Is there a fix for CVE-2018-25343?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2018-25343 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2018-25343?** Check whether you run Smakosh Smartshop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in Smartshop version 1.0 and earlier within the 'editprofile.php' component. The application fails to implement anti-CSRF tokens or similar validation mechanisms for profile update requests. An attacker can exploit this by hosting a malicious HTML page containing a hidden form that targets the administrative profile update endpoint. If an authenticated administrator visits this page, the browser will automatically submit the form, allowing the attacker to change the administrator's email and password without their knowledge. This vulnerability requires the victim to be authenticated and to interact with a malicious link or site.

## Affected products

- Smakosh Smartshop 1.0 and earlier

## Timeline

- 2018-06-02: disclosed: Initial exploit published on Exploit-DB
- 2026-05-23: advisory: CVE published and assigned by VulnCheck

## References

- [https://github.com/smakosh/Smartshop/archive/master.zip](https://github.com/smakosh/Smartshop/archive/master.zip)
- [https://www.behance.net/gallery/49080415/Smartshop-Free-e-commerce-website](https://www.behance.net/gallery/49080415/Smartshop-Free-e-commerce-website)
- [https://www.exploit-db.com/exploits/44824](https://www.exploit-db.com/exploits/44824)
- [https://www.vulncheck.com/advisories/smartshop-1-cross-site-request-forgery-via-editprofile-php](https://www.vulncheck.com/advisories/smartshop-1-cross-site-request-forgery-via-editprofile-php)

## Related threats

- [Smakosh Smartshop SQL injection in search.php](https://junglewise.ai/threats/cve-2018-25342-smakosh-smartshop-sql-injection-in-search-php)
- [Smakosh Smartshop SQL injection in multiple components](https://junglewise.ai/threats/cve-2018-25341-smakosh-smartshop-sql-injection-in-multiple-components)
- [Smakosh Smartshop SQL injection in category.php](https://junglewise.ai/threats/cve-2018-25340-smakosh-smartshop-sql-injection-in-category-php)