{"cvss":0.0,"datePublished":"2025-11-05T00:00:00Z","dateUpdated":"2025-11-05T00:00:00Z","description":"A remote code execution vulnerability exists within osCommerce Online Merchant version 2.3.4.1 due to insecure default configuration and missing authentication in the installer workflow. By default, the /install/ directory remains accessible after installation. An unauthenticated attacker can invoke install_4.php, submit crafted POST data, and inject arbitrary PHP code into the configure.php file. When the application later includes this file, the injected payload is executed, resulting in full server-side compromise.","dueDate":"","id":"CVE-2018-25114","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"online_merchant","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"HIGH","source":"vulncheck_kev","title":"oscommerce online_merchant Improper Control of Generation of Code","vendor":"oscommerce"}