CVE-2018-25343

Vulnerability

Smartshop version 1, an e-commerce PHP/MySQL website [3], contains a cross-site request forgery (CSRF) vulnerability in the editprofile.php file. The application lacks anti-CSRF tokens, allowing attackers to forge requests to modify user profiles. The vulnerable parameter handling in editprofile.php accepts email, password, and confirmation fields via POST without validating the request origin [1][2].

Exploitation

An attacker can craft an HTML form that automatically submits POST requests to the editprofile.php endpoint on the target Smartshop installation. The form includes hidden fields for email, password, and confirmation parameters. An authenticated admin user only needs to visit the malicious page (e.g., via a crafted link or phishing email) for the form to auto-submit using JavaScript [2]. No additional interaction beyond visiting the page is required. The attacker can change the admin's email and password, effectively hijacking the account.

Impact

Successful exploitation allows an attacker to change the email address and password of the admin user. This results in complete account takeover, leading to unauthorized access to the admin panel. The attacker can then perform any administrative actions, such as modifying products, users, or site settings. The impact is primarily integrity and availability loss, as the attacker can alter site content and potentially lock out the legitimate admin [1][2].

Mitigation

A patched version has not been disclosed in the available references. Since the latest known version is 1.0 [1] and the project appears unmaintained (last update in 2017) [3], users should implement a web application firewall (WAF) rule to block POST requests to editprofile.php that lack a valid CSRF token, or manually add anti-CSRF tokens to the application. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog.