CVE-2021-47953

The OpenCart v4.2.0.0 extension installer does not validate that extracted paths stay within the intended directory. An attacker can craft a malicious extension with path traversal sequences to write files, such as a PHP web shell, into the webroot.

OpenCart version 3.0.3.8 contains a session fixation vulnerability that allows attackers to hijack user sessions by injecting arbitrary values into the OCSESSID cookie. Attackers can set malicious OCSESSID cookie values that the server accepts and maintains, enabling session takeover and unauthorized access to user accounts.

A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of the file catalog/controller/account/edit.php of the component Autocomplete Workflow. This manipulation of the argument firstname causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown function of the file catalog/controller/account/address.php of the component Autocomplete Workflow. The manipulation of the argument address_1 results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

OpenCart 3.0.3.6 has a cross-site request forgery vulnerability in the /account/edit endpoint, allowing unauthenticated attackers to modify victim account details by tricking users into visiting malicious pages. Attackers can change email addresses and use password reset to take over accounts.