CVE-2019-25577

MEDIUM

SeoToaster Ecommerce 3.0.0 Local File Inclusion via backend_theme

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-25577. PoCs published by Ihsan Sencan.

AI-analyzed exploit summary The exploit demonstrates a Local File Inclusion (LFI) vulnerability in SeoToaster Ecommerce 3.0.0 by sending crafted POST requests to the `/backend/backend_theme/editcss/` and `/backend/backend_theme/editjs/` endpoints with manipulated `getcss` and `getjs` parameters to include arbitrary files.

Description

SeoToaster Ecommerce 3.0.0 contains a local file inclusion vulnerability that allows authenticated attackers to read arbitrary files by manipulating path parameters in backend theme endpoints. Attackers can send POST requests to /backend/backend_theme/editcss/ or /backend/backend_theme/editjs/ with directory traversal sequences in the getcss or getjs parameters to retrieve file contents.

Exploits (1)

exploitdb WORKING POC
by Ihsan Sencan · textwebappsphp
https://www.exploit-db.com/exploits/46190

The exploit demonstrates a Local File Inclusion (LFI) vulnerability in SeoToaster Ecommerce 3.0.0 by sending crafted POST requests to the `/backend/backend_theme/editcss/` and `/backend/backend_theme/editjs/` endpoints with manipulated `getcss` and `getjs` parameters to include arbitrary files.

Classification
Working Poc 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: SeoToaster Ecommerce 3.0.0
Auth required
Prerequisites: Valid session cookies (PHPSESSID, mwui, etc.) · Access to the backend interface
devstral-2 · analyzed Mar 21, 2026 Full analysis →

References (4)

Core 4
Core References
Exploit exploit
ExploitDB-46190
https://www.exploit-db.com/exploits/46190
Product product
Official Product Homepage
https://www.seotoaster.com/shopping-cart/
Third Party Advisory third-party-advisory
VulnCheck Advisory: SeoToaster Ecommerce 3.0.0 Local File Inclusion via backend_theme
https://www.vulncheck.com/advisories/seotoaster-ecommerce-local-file-inclusion-via-backend-theme

Scores

CVSS v3 5.5
EPSS 0.0088
EPSS Percentile 54.3%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (2)
seotoaster/seotoaster < 3.0.0
Seotoaster/SeoToaster Ecommerce 3.0.0
Published Mar 21, 2026
Tracked Since Mar 21, 2026