An unauthenticated account creation vulnerability in the detronetdip E-commerce platform allows attackers to bypass administrative controls and register unauthorized accounts.

The vulnerability exists due to missing authentication checks in the Admin/assets/backend/seller/add_seller.php and add_user.php scripts. An unauthenticated attacker can send direct POST requests to these endpoints to create active accounts, bypassing all registration workflows and administrative approval processes.

Successful exploitation allows unauthorized individuals to gain access to the application as registered users or sellers. This can lead to privilege escalation, data manipulation, and the potential for large-scale fraud or spam through the creation of malicious accounts. While the CVSS score of 7.3 reflects the severity of the access control failure, the ability to bypass administrative registration workflows poses a significant risk to system integrity.

Immediate Action: As no official vendor patch is currently available, administrators must restrict access to the /Admin/assets/backend/ directory at the web server level to ensure only authorized administrative IP addresses can reach these scripts.

Proactive Monitoring: Monitor server access logs for anomalous POST requests directed at /Admin/assets/backend/seller/add_seller.php or /Admin/assets/backend/user/add_user.php, particularly those originating from unknown or external IP addresses.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block direct access to administrative backend PHP files from unauthorized users and require valid session cookies for all requests to the /Admin/assets/ path.

Public Exploit Available: Yes, a functional proof-of-concept exists via the GitHub repository referenced in the vulnerability disclosure.

Given the lack of a vendor-provided fix and the public availability of exploit code, organizations utilizing detronetdip E-commerce 1.0.0 should immediately implement strict access controls on the vulnerable backend endpoints. Preventing unauthorized access to these scripts is critical to maintaining the security of the user database and preventing administrative privilege escalation.