CVE-2018-25200: PHP OOP CMS Blog CSRF Vulnerability

CVE-2018-25200 Overview

CVE-2018-25200 is a Cross-Site Request Forgery (CSRF) vulnerability affecting OOP CMS BLOG version 1.0. This vulnerability allows unauthenticated attackers to create administrative user accounts by crafting malicious POST requests. Attackers can submit forms to the addUser.php endpoint with parameters including userName, password, email, and role set to administrative privileges to gain unauthorized access to the content management system.

Critical Impact
Successful exploitation enables attackers to create rogue administrative accounts, leading to complete takeover of the CMS, unauthorized content modification, and potential compromise of the underlying web server.

Affected Products

Tomalofficial PHP OOP CMS Blog 1.0
Systems running php_oop_cms_blog version 1.0

Discovery Timeline

2026-03-06 - CVE-2018-25200 published to NVD
2026-03-11 - Last updated in NVD database

Technical Details for CVE-2018-25200

Vulnerability Analysis

This vulnerability exists due to the absence of anti-CSRF token validation in the user creation functionality of OOP CMS BLOG. The addUser.php endpoint processes POST requests without verifying the legitimacy of the request origin, allowing attackers to forge requests on behalf of authenticated administrators. When an authenticated administrator visits a malicious page crafted by an attacker, the browser automatically submits the forged request with the administrator's session cookies, executing the unauthorized action.

The vulnerability is classified under CWE-352 (Cross-Site Request Forgery), which represents a class of attacks where a malicious website causes a victim's browser to perform an unwanted action on a trusted site where the victim is authenticated.

Root Cause

The root cause of this vulnerability is the failure to implement proper CSRF protection mechanisms in the addUser.php script. The application accepts and processes form submissions without validating that the request originated from a legitimate form within the application. Key missing security controls include:

Absence of CSRF tokens in form submissions
No verification of HTTP Referer or Origin headers
Lack of SameSite cookie attributes to prevent cross-origin request submissions

Attack Vector

The attack vector is network-based and requires no authentication from the attacker. An attacker can exploit this vulnerability by:

Crafting a malicious HTML page containing a hidden form that targets the vulnerable addUser.php endpoint
Tricking an authenticated administrator into visiting the malicious page
The form automatically submits a POST request with attacker-controlled parameters (userName, password, email, role)
The CMS processes the request using the administrator's session, creating a new administrative account
The attacker gains administrative access using the newly created credentials

For technical details on the exploitation technique, refer to the Exploit-DB #45794 and the Vulncheck Advisory on CSRF.

Detection Methods for CVE-2018-25200

Indicators of Compromise

Unexpected administrative user accounts appearing in the CMS database
User creation events without corresponding legitimate administrator sessions
Unusual HTTP POST requests to addUser.php with external Referer headers
Multiple user account creations originating from unusual IP addresses or geographic locations

Detection Strategies

Monitor web server access logs for POST requests to addUser.php with suspicious Referer headers
Implement alerting for new administrative user account creation events
Review user account database tables for accounts created without proper audit trails
Deploy Web Application Firewall (WAF) rules to detect cross-origin form submissions targeting user management endpoints

Monitoring Recommendations

Enable verbose logging for all user management operations in the CMS
Configure alerts for administrative account creation outside of normal business hours
Implement database change detection to identify unauthorized modifications to user tables
Monitor for suspicious patterns such as rapid sequential account creations

How to Mitigate CVE-2018-25200

Immediate Actions Required

Audit current administrative user accounts and remove any unauthorized entries
Restrict access to the CMS administrative interface using IP whitelisting
Consider taking the vulnerable application offline until a proper fix is implemented
Implement network-level access controls to limit who can reach the addUser.php endpoint

Patch Information

No official vendor patch has been released for this vulnerability. Organizations using OOP CMS BLOG 1.0 should implement the workarounds below or consider migrating to an actively maintained CMS platform with proper security controls.

Workarounds

Implement custom CSRF token validation by modifying the addUser.php script to generate and verify anti-CSRF tokens
Add SameSite=Strict attribute to session cookies to prevent cross-origin submission of authenticated requests
Implement HTTP Referer and Origin header validation to reject requests from external sources
Deploy a Web Application Firewall (WAF) configured to block suspicious cross-site requests
Consider replacing the vulnerable CMS with a more secure, actively maintained alternative

bash

# Apache .htaccess configuration to restrict access to addUser.php
<Files "addUser.php">
    # Restrict to specific IP addresses
    Require ip 192.168.1.0/24
    # Alternatively, require authentication
    AuthType Basic
    AuthName "Restricted Access"
    AuthUserFile /etc/apache2/.htpasswd
    Require valid-user
</Files>