OpenCart Cross-Site Request Forgery (CSRF) in opencart/opencart
Summary
CVE-2018-13067: OpenCart Cross-Site Request Forgery (CSRF). Affects opencart/opencart versions < 3.0.2.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCart is an open-source e-commerce platform that allows users to create online stores. It provides various features for managing products, orders, and customer accounts. However, OpenCart versions up to 3.0.2.0 are vulnerable to Cross-Site Request Forgery (CSRF) attacks.
Vulnerability Detail
The vulnerability exists in the /upload/catalog/controller/account/password.php file of OpenCart. An attacker can exploit this vulnerability by sending a malicious request to the index.php?route=account/password URI, which allows them to change a user's password without their consent. This CSRF attack can lead to unauthorized access to user accounts and potential misuse of sensitive information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to a patched version of OpenCart to mitigate the risk of CSRF attacks.
Conclusion
OpenCart versions up to 3.0.2.0 are vulnerable to Cross-Site Request Forgery (CSRF) attacks. To mitigate this vulnerability, users should update their installations to a version beyond 3.0.2.0. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for opencart/opencart →
FAQ
OpenCart is an open-source e-commerce platform that allows users to create online stores.
Cross-Site Request Forgery (CSRF) is an attack that tricks the victim into submitting a malicious request. In the case of OpenCart, it allows an attacker to change a user's password without their consent.
An attacker can exploit this vulnerability by sending a malicious request to the index.php?route=account/password URI, which triggers the password change process without the user's knowledge.
This vulnerability can lead to unauthorized access to user accounts and potential misuse of sensitive information, as an attacker can change a user's password without their consent.
To protect your OpenCart installation, it is crucial to update to a version beyond 3.0.2.0, which includes security patches addressing this CSRF vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for opencart/opencart.
