CVE-2025-1746
📋 TL;DR
This is a Cross-Site Scripting (XSS) vulnerability in OpenCart that allows attackers to execute malicious JavaScript in victims' browsers via crafted URLs to the /product/search endpoint. Attackers could steal session cookies or perform actions as authenticated users. All OpenCart installations prior to version 4.1.0 are affected.
💻 Affected Systems
- OpenCart
📦 What is this software?
Opencart by Opencart
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover, session hijacking, theft of sensitive user data, and unauthorized administrative actions if admin sessions are compromised.
Likely Case
Session cookie theft leading to account compromise for regular users, potential for credential harvesting via phishing.
If Mitigated
Limited impact if proper Content Security Policy (CSP) headers are implemented and session cookies are HttpOnly/Secure.
🎯 Exploit Status
XSS vulnerabilities are commonly weaponized. Exploitation requires user interaction (clicking malicious link).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.1.0
Vendor Advisory: https://www.incibe.es/incibe-cert/alerta-temprana/avisos/multiples-vulnerabilidades-en-opencart
Restart Required: No
Instructions:
1. Backup your OpenCart installation and database. 2. Download OpenCart 4.1.0 or later from the official website. 3. Replace all files except config.php, admin/config.php, and image/data directories. 4. Run the database update if required. 5. Clear browser cache and test functionality.
🔧 Temporary Workarounds
Input Sanitization Workaround
allAdd input validation to sanitize search parameters before processing.
Modify catalog/controller/product/search.php to add htmlspecialchars() or similar sanitization to search parameters
WAF Rule Implementation
allImplement Web Application Firewall rules to block XSS payloads in search parameters.
Add WAF rule: Detect and block strings containing <script>, javascript:, or common XSS patterns in URL parameters
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to block inline scripts and unauthorized sources.
- Configure session cookies as HttpOnly and Secure to prevent JavaScript access.
🔍 How to Verify
Check if Vulnerable:
Test by accessing /index.php?route=product/search&search=<script>alert('XSS')</script> and checking if script executes. Use browser developer tools to inspect response.Check Version:
Check admin dashboard or view system/info.php if enabled. Also check includes/version.php for OC_VERSION constant.Verify Fix Applied:
After patching, repeat the test above - script should not execute and should be properly encoded in output.📡 Detection & Monitoring
Log Indicators:
- Unusual search queries containing script tags or JavaScript code in access logs
- Multiple failed search attempts with malicious payloads
Network Indicators:
- HTTP requests to /product/search with encoded script tags or JavaScript in parameters
- Outbound connections to suspicious domains following search requests
SIEM Query:
source="web_access_logs" AND uri_path="/product/search" AND (search="*<script>*" OR search="*javascript:*")