CVE-2018-25397: CSRF Vulnerability in PHP-SHOP 1.0 – Admin Account Injection

Technical summary

CVE-2018-25397 is a CSRF vulnerability in PHP-SHOP 1.0 affecting the users.php endpoint. The vulnerability exists because the application does not implement CSRF protections (such as synchronizer tokens or SameSite cookie attributes) on administrative user creation functionality. An unauthenticated attacker can craft HTML containing a hidden form with POST parameters for name, email, password, and admin permissions. When an authenticated administrator is tricked into visiting a page hosting this malicious form, the browser automatically submits the request in the admin's authenticated session context, bypassing access controls and creating an unauthorized privileged account. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N reflects network-based attack surface, low attack complexity, no privilege requirements, but importantly requires no user interaction in the technical sense—though social engineering is the practical attack vector. The integrity impact reflects account creation and privilege escalation risk.

Business impact

Successful exploitation grants attackers persistent administrative access to the PHP-SHOP application. This enables unauthorized configuration changes, data theft, user account compromise, or malicious content injection. While the CVSS score is moderate, the functional impact is severe: admin-level compromise can lead to complete application takeover, affecting stored customer and transaction data. For organizations relying on PHP-SHOP for e-commerce or content management, this represents a clear path to credential persistence and lateral movement into downstream systems.

Affected systems

PHP-SHOP version 1.0 is the affected product. The vendors_products field in the source data is empty, indicating limited vendor verification in the original submission; organizations using PHP-SHOP should verify their exact version against the PHP-SHOP project release history or check for patched derivatives. Legacy or self-hosted installations of PHP-SHOP 1.0 are at direct risk.

Exploitability

This vulnerability is straightforward to exploit from a technical perspective. An attacker needs only to host a webpage containing HTML with a CSRF payload targeting the users.php endpoint. No authentication is required on the attacker side, and the attack leverages the browser's automatic credential transmission to execute the malicious request. The primary barrier is social engineering—convincing an authenticated administrator to visit the attacker's page. Once that occurs, account creation happens automatically without further user interaction, making this a high-confidence attack if admin visitation can be achieved. No public exploit code is known to be active as of the publication date, but the attack surface is well-understood and low-skill attackers could quickly weaponize this.

Remediation

The immediate remedy is to upgrade PHP-SHOP to a patched version addressing CSRF protections. Verify against the PHP-SHOP project advisories for the exact fixed release. Interim mitigation includes implementing CSRF tokens on all state-changing operations, enforcing SameSite cookie policies (Strict or Lax), and educating administrators about phishing risks. Web Application Firewalls can provide partial protection by detecting anomalous cross-site form submissions, though token-based defenses are the proper fix.

Patch guidance

Consult the PHP-SHOP project repository or official vendor advisories for patched releases. Organizations should prioritize testing patches in a staging environment given that admin account creation is a sensitive operation. If PHP-SHOP 1.0 is no longer actively maintained, consider migrating to a modern, supported e-commerce or CMS platform with built-in CSRF protections.

Detection guidance

Monitor web application logs for POST requests to users.php with admin-related parameters originating from unexpected referrer headers or cross-origin sources. Endpoint detection and response tools should flag unusual admin account creation events, particularly those occurring outside normal admin activity windows or from non-admin IP ranges. Review web server and PHP-SHOP logs for session anomalies. Network-based detection can identify outbound admin traffic from compromised sessions.

Why prioritize this

Although the CVSS score is moderate (5.3), the functional impact warrants elevated priority. Successful exploitation directly enables persistent administrative access—the highest privilege level in an application. For organizations running PHP-SHOP 1.0, this should be treated as a high-priority remediation item because the attack is low-friction, the impact is severe, and no exploit complexity or privilege requirements exist on the attacker side. Organizations not running PHP-SHOP can safely deprioritize, but those running it should patch or migrate immediately.

Risk score, explained

The CVSS 3.1 score of 5.3 (MEDIUM) reflects: network-accessible attack vector with low complexity, no requirement for prior authentication or user privileges on the attacker side, and no confidentiality or availability impact. However, the integrity impact is marked as low due to the scope being unchanged—but in practice, creating unauthorized admin accounts is a privilege escalation with cascading integrity and availability consequences. The score does not fully capture the post-exploitation risk of admin compromise. Organizations should apply business context: for PHP-SHOP deployments handling sensitive data, the effective risk is substantially higher than the base score suggests.

Frequently asked questions