CVE-2018-25397: Joeyrush PHP-Shop Master

Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days.

PHP-SHOP 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to add administrative users by crafting malicious HTML forms. Attackers can trick authenticated administrators into visiting a page containing a hidden form that automatically submits POST requests to the users.php endpoint with parameters like name, email, password, and permissions set to admin to create unauthorized admin accounts.

Affected products

• Joeyrush PHP-Shop Master: version 1.0 only

Published 2026-05-29. Last modified 2026-07-21.