An improper authentication vulnerability in InnoShop up to version 0.7.8 allows unauthenticated remote attackers to trigger an application re-installation, leading to complete data destruction and full administrative system takeover.

This is an improper authentication flaw (CWE-287) located in the InstallServiceProvider::boot function and the /install/complete installation endpoint, requiring no attacker authentication.

Successful exploitation of this vulnerability results in catastrophic business impact, including permanent and irreversible data loss due to database wiping, complete compromise of administrative access, and severe system downtime. With a CVSS score of 7.3, the vulnerability is classified as High severity, reflecting the critical nature of unauthenticated administrative account creation and destructive database commands executed via HTTP requests.

Immediate Action: Apply the vendor-provided security update or integrate the official patch (commit 45758e4ec22451ab944ae2ae826b1e70f6450dc9) to add the required installation guards.

Proactive Monitoring: Monitor web access logs for anomalous POST requests directed at the /install/complete endpoint and watch for unauthorized administrative account creations.

Compensating Controls: Deploy a Web Application Firewall rule to block external access to all paths matching /install/* after the initial application setup is complete.

Public Exploit Available: Yes, a public proof-of-concept exists (sourced from GitHub issue #314 and associated research write-ups).

Administrators must treat this vulnerability with high urgency due to the destructive potential of unauthenticated application re-initialization. Apply the official patch or upgrade beyond version 0.7.8 immediately to prevent complete system takeover and data compromise.