eMarket Online Store. It is a free online shop engine. Make the best online shop with us. Join our Open Source community. Together we will make the best free e-commerce solution.
Sending a specifically crafted post request to controller/install/success.php allows for a full site takeover, since /model/eMarket/Install/Success.php blindly writes away the config without any form of verification upon a well formed POST request.
I urge you to review the most common pitfalls https://owasp.org/www-project-top-ten/ as well as the current PHP best practices on https://phptherightway.com/ before starting anything related to e-commerce, as this project is full of security holes and bad practices detrimental for security.