Description
A remote code execution vulnerability exists within osCommerce Online Merchant version 2.3.4.1 due to insecure default configuration and missing authentication in the installer workflow. By default, the /install/ directory remains accessible after installation. An unauthenticated attacker can invoke install_4.php, submit crafted POST data, and inject arbitrary PHP code into the configure.php file. When the application later includes this file, the injected payload is executed, resulting in full server-side compromise.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| osCommerce | Online Merchant | 2.3.4.1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
osCommerce Installer Unauthenticated Code Execution
exploit/multi/http/oscommerce_installer_unauth_code_exec
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- osCommerce 2.3.4.1 - Remote Code Execution http/cves/2018/CVE-2018-25114.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://www.exploit-db.com/exploits/44374 exploit
- https://www.oscommerce.com/ product
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/oscommerce_installer_unauth_code_exec.rb exploit
- https://www.vulncheck.com/advisories/oscommerce-installer-unauth-config-file-injection-php-code-execution third-party-advisory