CVE-2018-25114: oscommerce online_merchant Code Injection

Vulnerability summary

CVE-2018-25114 is a critical (CVSS 9.3) Code Injection vulnerability in oscommerce online_merchant. EPSS estimates a 4.47% chance of exploitation in the next 30 days, higher than 91.3% of scored vulnerabilities. 3 public exploits are recorded.

Timeline

1. 23-07-2025
   PublishedVulnerability first disclosed.
2. 07-04-2026
   Last modifiedVulnerability information updated.

Description

A remote code execution vulnerability exists within osCommerce Online Merchant version 2.3.4.1 due to insecure default configuration and missing authentication in the installer workflow. By default, the /install/ directory remains accessible after installation. An unauthenticated attacker can invoke install_4.php, submit crafted POST data, and inject arbitrary PHP code into the configure.php file. When the application later includes this file, the injected payload is executed, resulting in full server-side compromise.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
• CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.