OpenCart Path Traversal Vulnerability in opencart/opencart
Summary
CVE-2018-11495: OpenCart Path Traversal. Affects opencart/opencart versions < 3.0.2.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCart is an open-source e-commerce platform that allows users to create and manage online stores. It provides various features for product management, order processing, and customer management. The vulnerability affects OpenCart versions up to 3.0.2.0.
Vulnerability Detail
The OpenCart Path Traversal vulnerability allows an attacker to perform directory traversal attacks through the editDownload function in admin\model\catalog\download.php. By exploiting this vulnerability, an attacker can manipulate the download_id parameter in the URL (admin/index.php?route=catalog/download/edit) to download sensitive files outside the intended directory. For example, an attacker can download ../../config.php, which may contain sensitive information such as database credentials.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading to a patched version is not immediately feasible, users can implement a temporary workaround by modifying the affected file (admin\model\catalog\download.php). The following code snippet can be added to the editDownload function to sanitize the download_id parameter:
$download_id = str_replace(array('../', '..\', '..'), '', $download_id);
Conclusion
The OpenCart Path Traversal vulnerability allows attackers to download sensitive files from the server. It is crucial to upgrade to a patched version of OpenCart (3.0.2.1 or later) to mitigate this vulnerability. If immediate upgrading is not possible, implementing the provided workaround can help protect the system. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for opencart/opencart →
FAQ
OpenCart is an open-source e-commerce platform that allows users to create and manage online stores.
This vulnerability allows an attacker to download sensitive files from the server, potentially exposing sensitive information such as database credentials.
To fix this vulnerability, it is recommended to upgrade to OpenCart version 3.0.2.1 or any subsequent version that includes the fix.
Yes, if upgrading to a patched version is not immediately feasible, users can implement a temporary workaround by modifying the affected file (admin\model\catalog\download.php). The provided code snippet can be added to sanitize the download_id parameter.
For more information about this vulnerability, you can refer to the official GitHub advisory database or contact the OpenCart development team.
Related vulnerabilities
Recent vulnerabilities recorded for opencart/opencart.
