PT-2025-30585 · Unknown · Oscommerce Online Merchant

Published 2025-07-23 · Updated 2025-07-23 · CVE-2018-25114

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions osCommerce Online Merchant version 2.3.4.1

Description A remote code execution issue exists due to insecure default configuration and missing authentication in the installer workflow. The /install/ directory remains accessible after installation. An unauthenticated attacker can invoke install 4.php, submit crafted POST data, and inject arbitrary PHP code into the configure.php file. When the application includes this file, the injected payload is executed, resulting in full server-side compromise.

Recommendations Versions prior to 2.3.4.1 are affected. Remove the /install/ directory after installation to prevent unauthorized access to install 4.php. Ensure proper authentication mechanisms are implemented within the installer workflow.

Fix

RCE

Unrestricted File Upload

Code Injection

Weakness Enumeration

CWE-434

CWE-94

Related Identifiers

CVE-2018-25114

Affected Products

Oscommerce Online Merchant

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2018-25114 · Security Note
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/oscommerce_installer_unauth_code_exec.rb · Note
• https://vulncheck.com/advisories/oscommerce-installer-unauth-config-file-injection-php-code-execution · Note
• https://oscommerce.com · Note
• https://exploit-db.com/exploits/44374 · Note
• https://t.me/CVEtracker/28492 · Telegram Post