CVE-2018-25397: PHP-SHOP 1.0 CSRF Vulnerability

CVE-2018-25397 Overview

CVE-2018-25397 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in PHP-SHOP 1.0, an open-source PHP shopping cart application maintained on GitHub by joeyrush. The flaw resides in the users.php administrative endpoint, which accepts state-changing POST requests without validating an anti-CSRF token or verifying the request origin. An attacker can host a malicious HTML page that auto-submits a forged form to create a new administrator account when an authenticated admin visits the page. Successful exploitation yields persistent administrative access to the affected shop instance.

Critical Impact

Attackers can silently create attacker-controlled administrator accounts in PHP-SHOP 1.0 by tricking a logged-in administrator into loading a crafted web page.

Affected Products

• PHP-SHOP 1.0 (joeyrush/PHP-SHOP)
• Deployments using the users.php administrative endpoint
• Any forked or derivative codebase retaining the unpatched users.php handler

Discovery Timeline

• 2018 - Public proof-of-concept published as Exploit-DB #45636
• 2026-05-29 - CVE-2018-25397 published to NVD
• 2026-05-29 - Last updated in NVD database

Technical Details for CVE-2018-25397

Vulnerability Analysis

The vulnerability is a classic CSRF flaw in the administrative user management workflow. PHP-SHOP 1.0 exposes users.php as the endpoint for creating and modifying user accounts, but the handler relies solely on the administrator's session cookie for authorization. It does not require a per-request CSRF token, does not validate the Origin or Referer header, and does not enforce a SameSite policy on the session cookie. As a result, any cross-origin POST submitted by an authenticated administrator's browser is processed as a legitimate request. The endpoint accepts name, email, password, and permissions parameters and writes the new account directly to the database when permissions=admin is supplied.

Root Cause

The root cause is missing CSRF protection on a state-changing administrative endpoint, classified under [CWE-352]. The application trusts session-based authentication exclusively and does not bind requests to a token tied to the user's session. There is no server-side check that the POST originated from an in-application form, which permits cross-origin form submissions to mutate server state.

Attack Vector

Exploitation requires social engineering: an authenticated PHP-SHOP administrator must visit an attacker-controlled web page while their session is active. The page hosts a hidden HTML form targeting the administrator's PHP-SHOP users.php endpoint with method POST and fields for name, email, password, and permissions=admin. JavaScript on the page submits the form automatically. The victim's browser attaches the active session cookie, the server processes the request as authorized, and a new administrator account is created with credentials known to the attacker. No interaction with the form itself is required from the victim. Technical details and a working proof-of-concept are documented in the VulnCheck Advisory on PHP-SHOP CSRF and Exploit-DB #45636.

Detection Methods for CVE-2018-25397

Indicators of Compromise

• Unexpected administrator accounts present in the PHP-SHOP users table, particularly accounts with unfamiliar name or email values and permissions=admin.
• Web server access logs showing POST /users.php requests whose Referer header points to a domain outside the application.
• POST /users.php requests immediately following navigation events to external sites by administrator IP addresses.
• New account creation events that lack a corresponding prior GET to the admin user-creation form.

Detection Strategies

• Review PHP-SHOP database tables for administrator accounts that were not provisioned through change-management processes.
• Parse web server logs for POST requests to users.php with missing, empty, or cross-origin Referer and Origin headers.
• Correlate session activity to flag administrative actions that occur within seconds of an admin loading an external URL.
• Implement web application firewall rules that alert on users.php POST requests containing permissions=admin.

Monitoring Recommendations

• Forward PHP-SHOP web server and application logs to a centralized logging platform and alert on administrative account creation.
• Monitor outbound browser activity from administrator workstations for visits to untrusted domains while admin sessions are active.
• Establish a baseline of legitimate administrator account changes and alert on deviations.

How to Mitigate CVE-2018-25397

Immediate Actions Required

• Audit the PHP-SHOP users table and remove any unrecognized administrator accounts.
• Force a password reset and session invalidation for all existing administrators.
• Restrict access to the /admin and users.php paths to trusted internal IP ranges using web server access controls.
• Instruct administrators to log out of PHP-SHOP before browsing unrelated sites until a fix is in place.

Patch Information

No official vendor patch is referenced in the advisory data for CVE-2018-25397. Operators should apply application-level fixes by adding a synchronizer token pattern (anti-CSRF token) to all state-changing forms in users.php, validating the Origin and Referer headers on POST requests, and setting the session cookie to SameSite=Strict. Review the upstream repository at the GitHub PHP-SHOP Archive before deploying any code changes.

Workarounds

• Place the PHP-SHOP administrative interface behind an authenticated reverse proxy or VPN that enforces additional origin checks.
• Configure the session cookie with SameSite=Strict and Secure attributes in PHP via session_set_cookie_params() to block cross-site cookie attachment.
• Add a web application firewall rule that blocks POST requests to users.php lacking an in-application Referer header.
• Disable or remove the users.php endpoint if administrator provisioning can be performed directly against the database.

# Example: enforce SameSite and Secure cookies in php.ini
session.cookie_samesite = "Strict"
session.cookie_secure = 1
session.cookie_httponly = 1