CVE-2025-3975: Ecommerce-website-in-php Info Disclosure

CVE-2025-3975 Overview

CVE-2025-3975 is an information disclosure vulnerability in ScriptAndTools eCommerce-website-in-PHP version 3.0. The flaw resides in the /admin/subscriber-csv.php script, which improperly handles requests and exposes sensitive subscriber data. Attackers can trigger the issue remotely without authentication or user interaction. The exploit details have been publicly disclosed, increasing the risk of opportunistic abuse against exposed installations. The vulnerability is classified under [CWE-200] Information Exposure.

Critical Impact
Remote unauthenticated attackers can retrieve subscriber data through the /admin/subscriber-csv.php endpoint, leading to leakage of customer contact information stored in the eCommerce application.

Affected Products

ScriptAndTools eCommerce-website-in-PHP 3.0
CPE: cpe:2.3:a:scriptandtools:ecommerce-website-in-php:3.0:*:*:*:*:*:*:*
Deployments exposing the /admin/ directory to untrusted networks

Discovery Timeline

2025-04-27 - CVE-2025-3975 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3975

Vulnerability Analysis

The vulnerability affects the /admin/subscriber-csv.php script, which generates a CSV export of the subscriber database. The script fails to enforce proper access controls before returning the CSV payload. Unauthenticated remote clients can request the endpoint over HTTP and receive subscriber records intended only for administrators. The exposed data typically includes email addresses and other subscription metadata harvested by the eCommerce platform. Because the export path is predictable and reachable over the network, exploitation requires only a single HTTP request.

Root Cause

The root cause is missing authentication and authorization enforcement on an administrative export endpoint. The script executes its data retrieval logic without validating whether the caller holds an active administrator session. This design flaw maps to [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor. Similar patterns appear in PHP applications that place enforcement in the UI layer rather than at each admin script entry point.

Attack Vector

An attacker sends a direct HTTP GET request to /admin/subscriber-csv.php on a vulnerable host. The server responds with a CSV document containing subscriber records. No credentials, tokens, or referrer values are required. The attack is fully network-based and can be automated against internet-exposed installations discovered through search engines or scanning. Refer to the VulDB advisory and the Web Security Insights writeup for additional technical context.

Detection Methods for CVE-2025-3975

Indicators of Compromise

HTTP requests targeting /admin/subscriber-csv.php from external or unexpected source addresses.
Web server access logs showing 200 OK responses for the CSV endpoint without a preceding authenticated admin login.
Outbound CSV responses whose Content-Type is text/csv or application/octet-stream from admin paths accessed anonymously.

Detection Strategies

Deploy web server log analytics that alert on unauthenticated access to any URI beginning with /admin/.
Use a web application firewall rule to flag requests to subscriber-csv.php that lack a valid session cookie.
Correlate response size spikes on the export endpoint with source IP reputation to surface bulk scraping attempts.

Monitoring Recommendations

Forward Apache or Nginx access logs to a centralized analytics platform for continuous review of admin endpoint activity.
Baseline normal administrator export patterns and alert on off-hours or geographically anomalous requests.
Monitor egress traffic volume from the web server to catch large CSV exfiltration events.

How to Mitigate CVE-2025-3975

Immediate Actions Required

Restrict access to the /admin/ directory using web server ACLs or IP allowlists until a patched build is available.
Require HTTP basic authentication or a reverse proxy authentication layer in front of all admin scripts.
Rotate any subscriber data that may have been exposed and notify affected users where required by regulation.

Patch Information

No vendor advisory or official patch has been published by ScriptAndTools at the time of NVD publication. Operators should track the VulDB entry for updates and consider replacing the affected script with an access-controlled equivalent if the vendor does not release a fix.

Workarounds

Add a server-side authentication check at the top of /admin/subscriber-csv.php that validates the administrator session before any output is emitted.
Block direct external access to /admin/subscriber-csv.php at the web server or WAF layer.
Remove or rename the export script if the CSV export functionality is not required in production.

bash

# Nginx example: restrict the admin directory to trusted networks
location ^~ /admin/ {
    allow 10.0.0.0/8;
    deny all;
    auth_basic "Restricted";
    auth_basic_user_file /etc/nginx/.htpasswd;
}