CVE-2018-25397

Name of the Vulnerable Software and Affected Versions PHP-SHOP version 1.0

Description A cross-site request forgery (CSRF) issue allows unauthenticated attackers to create unauthorized administrative accounts. This occurs when authenticated administrators are tricked into visiting a page with a hidden HTML form that automatically sends POST requests to the 'users.php' endpoint. The attack utilizes the name, email, password, and permissions variables, setting the latter to admin to grant full administrative privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.