CVE-2026-2165 is a missing authentication flaw in detronetdip E-commerce 1.0.0, scored 7.3 (High). The seller account creation page under the admin folder can be reached without logging in. The project was told early through an issue report but has not responded, so no fix is listed. Block the admin path or retire the app.
What's affected
- Product: detronetdip E-commerce
- Affected version: 1.0.0
- Location:
/Admin/assets/backend/seller/add_seller.php(account creation endpoint), through the email argument - Fixed version: none. The record says the project was informed through an issue report and has not responded
- Public detail: the record says an exploit has been made available publicly. The CVE is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
See whether the app runs anywhere you own:
find /var/www /srv /opt /home -path "*/Admin/assets/backend/seller/add_seller.php" 2>/dev/null
If it turns up, test from outside your network whether the admin folder answers without a login. A properly protected admin area should redirect to a sign in page or refuse the request. Then look at the seller and user tables for accounts you did not create.
What to do now
- Locate every copy of the app, including staging and backup servers.
- Block the admin folder at the web server or behind a VPN, so only known addresses can reach it.
- Check seller and admin accounts for anything unfamiliar and remove it, then reset passwords for real admins.
- Add an authentication check to the account creation script, or retire the app if no one maintains it.
- Watch the project issue tracker for a fix before you decide to keep it.
Why it matters
The record lists CWE-287, improper authentication, and CWE-306, missing authentication for a critical function. The page that creates seller accounts does not check that the caller is signed in. Creating accounts is a privileged action, so leaving it open lets a stranger add themselves to your store.
Small shop and demo applications often put their admin code in a folder and assume the folder name is a protection. It is not. Every privileged script needs its own check, or the whole folder must sit behind server level authentication.
With no response from the project, the fix is yours to own. Either add the check or retire the app.
Quick check
Is there a fixed version?
The record lists none, and says the project had not responded to the issue report. Check the repository before you decide.
What is the fastest control?
Restrict the admin folder at the web server or the network, so the script cannot be reached from outside.
Sources
Last reviewed: 19 October 2026.
