Remote Code Execution Vulnerability in osCommerce Online Merchant by osCommerce
CVE-2018-25114

9.3CRITICAL

Key Information:

Vendor

Oscommerce

Status
Online Merchant
Vendor
CVE Published:
23 July 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2018-25114?

A remote code execution vulnerability exists in osCommerce Online Merchant version 2.3.4.1 stemming from an insecure default installation configuration and a lack of authentication during the installer workflow. As the /install/ directory is left accessible post-installation, an unauthorized attacker can invoke install_4.php, manipulate POST data, and insert arbitrary PHP code into the configure.php file. This code is later executed when the application references this file, potentially leading to a complete compromise of the server.

Affected Version(s)

Online Merchant 2.3.4.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2018-25114 - Proof of Concept

CVE-2018-25114 - Proof of Concept

References

https://www.exploit-db.com/exploits/44374
exploit
https://www.oscommerce.com/
product
https://raw.githubusercontent.com/rapid7/metasploit-frame...
exploit

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Simon Scannell
.
CVE-2018-25114 : Remote Code Execution Vulnerability in osCommerce Online Merchant by osCommerce