CVE-2018-25397: PHP-SHOP 1.0 CSRF Vulnerability

CVE-2018-25397 Overview

CVE-2018-25397 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in PHP-SHOP 1.0, an open-source PHP shopping cart application maintained on GitHub by joeyrush. The flaw resides in the users.php administrative endpoint, which accepts state-changing POST requests without validating an anti-CSRF token or verifying the request origin. An attacker can host a malicious HTML page that auto-submits a forged form to create a new administrator account when an authenticated admin visits the page. Successful exploitation yields persistent administrative access to the affected shop instance.

Critical Impact
Attackers can silently create attacker-controlled administrator accounts in PHP-SHOP 1.0 by tricking a logged-in administrator into loading a crafted web page.

Affected Products

PHP-SHOP 1.0 (joeyrush/PHP-SHOP)
Deployments using the users.php administrative endpoint
Any forked or derivative codebase retaining the unpatched users.php handler

Discovery Timeline

2018 - Public proof-of-concept published as Exploit-DB #45636
2026-05-29 - CVE-2018-25397 published to NVD
2026-05-29 - Last updated in NVD database

Technical Details for CVE-2018-25397

Vulnerability Analysis

The vulnerability is a classic CSRF flaw in the administrative user management workflow. PHP-SHOP 1.0 exposes users.php as the endpoint for creating and modifying user accounts, but the handler relies solely on the administrator's session cookie for authorization. It does not require a per-request CSRF token, does not validate the Origin or Referer header, and does not enforce a SameSite policy on the session cookie. As a result, any cross-origin POST submitted by an authenticated administrator's browser is processed as a legitimate request. The endpoint accepts name, email, password, and permissions parameters and writes the new account directly to the database when permissions=admin is supplied.

Root Cause

The root cause is missing CSRF protection on a state-changing administrative endpoint, classified under [CWE-352]. The application trusts session-based authentication exclusively and does not bind requests to a token tied to the user's session. There is no server-side check that the POST originated from an in-application form, which permits cross-origin form submissions to mutate server state.

Attack Vector

Exploitation requires social engineering: an authenticated PHP-SHOP administrator must visit an attacker-controlled web page while their session is active. The page hosts a hidden HTML form targeting the administrator's PHP-SHOP users.php endpoint with method POST and fields for name, email, password, and permissions=admin. JavaScript on the page submits the form automatically. The victim's browser attaches the active session cookie, the server processes the request as authorized, and a new administrator account is created with credentials known to the attacker. No interaction with the form itself is required from the victim. Technical details and a working proof-of-concept are documented in the VulnCheck Advisory on PHP-SHOP CSRF and Exploit-DB #45636.

Detection Methods for CVE-2018-25397

Indicators of Compromise

Unexpected administrator accounts present in the PHP-SHOP users table, particularly accounts with unfamiliar name or email values and permissions=admin.
Web server access logs showing POST /users.php requests whose Referer header points to a domain outside the application.
POST /users.php requests immediately following navigation events to external sites by administrator IP addresses.
New account creation events that lack a corresponding prior GET to the admin user-creation form.

Detection Strategies

Review PHP-SHOP database tables for administrator accounts that were not provisioned through change-management processes.
Parse web server logs for POST requests to users.php with missing, empty, or cross-origin Referer and Origin headers.
Correlate session activity to flag administrative actions that occur within seconds of an admin loading an external URL.
Implement web application firewall rules that alert on users.php POST requests containing permissions=admin.

Monitoring Recommendations

Forward PHP-SHOP web server and application logs to a centralized logging platform and alert on administrative account creation.
Monitor outbound browser activity from administrator workstations for visits to untrusted domains while admin sessions are active.
Establish a baseline of legitimate administrator account changes and alert on deviations.

How to Mitigate CVE-2018-25397

Immediate Actions Required

Audit the PHP-SHOP users table and remove any unrecognized administrator accounts.
Force a password reset and session invalidation for all existing administrators.
Restrict access to the /admin and users.php paths to trusted internal IP ranges using web server access controls.
Instruct administrators to log out of PHP-SHOP before browsing unrelated sites until a fix is in place.

Patch Information

No official vendor patch is referenced in the advisory data for CVE-2018-25397. Operators should apply application-level fixes by adding a synchronizer token pattern (anti-CSRF token) to all state-changing forms in users.php, validating the Origin and Referer headers on POST requests, and setting the session cookie to SameSite=Strict. Review the upstream repository at the GitHub PHP-SHOP Archive before deploying any code changes.

Workarounds

Place the PHP-SHOP administrative interface behind an authenticated reverse proxy or VPN that enforces additional origin checks.
Configure the session cookie with SameSite=Strict and Secure attributes in PHP via session_set_cookie_params() to block cross-site cookie attachment.
Add a web application firewall rule that blocks POST requests to users.php lacking an in-application Referer header.
Disable or remove the users.php endpoint if administrator provisioning can be performed directly against the database.

bash

# Example: enforce SameSite and Secure cookies in php.ini
session.cookie_samesite = "Strict"
session.cookie_secure = 1
session.cookie_httponly = 1