CVE-2018-25337 Joomla JoomOCShop 1.0 Cross-Site Request Forgery

MediumCVSS 5.3 EPSS 0.16%

Published: 2026-05-17 15:11
Updated: 2026-06-17 04:55
Exploit status: No public exploit known

Description

Joomla JoomOCShop 1.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on behalf of authenticated users. Attackers can craft malicious HTML forms targeting account endpoints like /joomoc2/?route=account/edit and to modify user information or reset passwords without user consent.

Affected products

Product	Affected versions	Fixed in
joomlaextensions Joomla! extension JoomOCShop	= 1.0	No fix listed

References

ExploitDB-44789 exploit
Official Product Homepage product
Product Reference product
VulnCheck Advisory: Joomla JoomOCShop 1.0 Cross-Site Request Forgery third-party-advisory

CVSS v4.0

5.3 Medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: Low
User Interaction: None
Vulnerable System Confidentiality: None
Vulnerable System Integrity: Low
Vulnerable System Availability: None
Subsequent System Confidentiality: Low
Subsequent System Integrity: Low
Subsequent System Availability: Low

All scores (4)

v4.0 5.3 · vulncheck
v4.0 5.3 · disclosure@vulncheck.com
v3.1 4.3 · vulncheck
v3.1 4.3 · disclosure@vulncheck.com

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.16% (percentile 5.7)
CWE: CWE-352 Cross-Site Request Forgery (CSRF)

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.