Executive brief
PHP-SHOP, an e-commerce platform, is vulnerable to a security flaw that allows attackers to create unauthorized administrator accounts. By tricking a legitimate administrator into visiting a malicious website, an attacker can force the administrator's browser to secretly submit a request that adds a new user with full administrative privileges. This could lead to a complete takeover of the online shop and its data.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in PHP-SHOP 1.0 within the admin/users.php component. The application fails to validate unique tokens for state-changing requests, allowing an unauthenticated remote attacker to craft a malicious HTML page. If an authenticated administrator visits this page, a hidden form automatically submits a POST request to the users.php endpoint. This request can include parameters for a new username, email, password, and administrative permissions, resulting in the creation of an unauthorized admin account. A proof-of-concept exploit is publicly available.
Affected products
- Joey Rush PHP-SHOP 1.0
Timeline
- 2018-10-15: disclosed: Vulnerability discovered and exploit developed
- 2018-10-18: other: Exploit published on Exploit-DB
- 2026-05-29: advisory: CVE-2018-25397 published by VulnCheck