osCommerce Online Merchant 2.3.4.1 HTTP POST Requst install_4.php unrestricted upload

Summaryinfo

A vulnerability, which was classified as critical, was found in osCommerce Online Merchant 2.3.4.1. This affects an unknown function of the file install_4.php of the component HTTP POST Requst Handler. The manipulation results in unrestricted upload. This vulnerability is cataloged as CVE-2018-25114. The attack may be launched remotely. Furthermore, there is an exploit available.

Detailsinfo

A vulnerability, which was classified as critical, was found in osCommerce Online Merchant 2.3.4.1. Affected is some unknown functionality of the file install_4.php of the component HTTP POST Requst Handler. The manipulation with an unknown input leads to a unrestricted upload vulnerability. CWE is classifying the issue as CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

A remote code execution vulnerability exists within osCommerce Online Merchant version 2.3.4.1 due to insecure default configuration and missing authentication in the installer workflow. By default, the /install/ directory remains accessible after installation. An unauthenticated attacker can invoke install_4.php, submit crafted POST data, and inject arbitrary PHP code into the configure.php file. When the application later includes this file, the injected payload is executed, resulting in full server-side compromise.

The weakness was shared by Simon Scannell as 44374. The advisory is shared for download at exploit-db.com. This vulnerability is traded as CVE-2018-25114 since 07/22/2025. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details and a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1608.002.

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept. By approaching the search of inurl:install_4.php it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Exploit-DB (44374). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• E-Commerce Management Software

Vendor

• osCommerce

Name

• Online Merchant

Version

• 2.3.4.1

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion