CVE-2018-25114

A remote code execution vulnerability exists within osCommerce Online Merchant version 2.3.4.1 due to insecure default configuration and missing authentication in the installer workflow. By default, the /install/ directory remains accessible after installation. An unauthenticated attacker can invoke install_4.php, submit crafted POST data, and inject arbitrary PHP code into the configure.php file. When the application later includes this file, the injected payload is executed, resulting in full server-side compromise.

• CWE-94
• CWE-434

• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/oscommerce_installer_unauth_code_exec.rb
• https://www.exploit-db.com/exploits/44374
• https://www.oscommerce.com/
• https://www.vulncheck.com/advisories/oscommerce-installer-unauth-config-file-injection-php-code-execution

Published

Jul 23, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-25108An unauthenticated remote attacker can cause a DoS in the co…7.5
• CVE-2018-25109A vulnerability has been found in Nintendo Animal Crossing, …6.4
• CVE-2018-25110Marked prior to version 0.3.17 is vulnerable to a Regular Ex…7.5
• CVE-2018-25111django-helpdesk before 1.0.0 allows Sensitive Data Exposure …4.4
• CVE-2018-25112An unauthenticated remote attacker may use an uncontrolled r…7.5
• CVE-2018-25113An unauthenticated path traversal vulnerability exists in Di…8.7
• CVE-2018-25115Multiple D-Link DIR-series routers, including DIR-110, DIR-4…9.8
• CVE-2018-25116MyBB Thread Redirect Plugin 0.2.1 contains a cross-site scri…6.1
• CVE-2018-25117VestaCP commit a3f0fa1 (2018-05-31) up to commit ee03eff (20…9.3
• CVE-2018-25118GeoVision embedded IP devices, confirmed on GV-BX1500 and GV…10
• CVE-2018-25119Nagios Fusion versions prior to 4.1.5 are vulnerable to cros…6.1
• CVE-2018-25120D-Link DNS-343 ShareCenter devices running firmware versions…9.8