CVE-2024-21516: Cross-Site Scripting in OpenCart
Summary
CVE-2024-21516: Cross site scripting in opencart. Affects opencart/opencart versions >= 4.0.0.0. No fix is published. How to fix ↓
Also tracked for
- opencart · Bitnami
The same CVE-2024-21516 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCart is an open-source e-commerce platform that allows users to create and manage online stores. It provides various features for product management, order processing, and customer management. The vulnerability affects versions of the package opencart/opencart from 4.0.0.0.
Vulnerability Detail
A reflected XSS issue was identified in the directory parameter of the admin common/filemanager.list route. By tricking a user into clicking on a maliciously crafted URL, an attacker can obtain the user's token. Upon authentication, the payload automatically executes, potentially leading to further exploits if the user has admin privileges. This vulnerability can be exploited if the attacker knows the name or path of the admin directory, which is 'admin' by default.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
To mitigate the risk, it is advised to rename the admin directory to a unique name. This can be done by following the instructions provided in the OpenCart dashboard.
Conclusion
OpenCart versions from 4.0.0.0 are vulnerable to a reflected XSS issue in the admin directory. While a partial fix has been implemented, it is recommended to rename the admin directory to mitigate the risk. Further updates and improvements are required to fully address this vulnerability.
See every vulnerability recorded for opencart/opencart →
FAQ
OpenCart is an open-source e-commerce platform for creating and managing online stores.
Versions of the package opencart/opencart from 4.0.0.0 are affected.
By tricking a user into clicking on a malicious URL, an attacker can obtain the user's token and execute a payload upon authentication.
No, this vulnerability can only be exploited if the attacker knows the name or path of the admin directory, which is 'admin' by default.
No, the fix for this vulnerability is incomplete. The redirect post admin login has been removed, but it is still possible to exploit the issue if the user is already authenticated as an admin.
References
Related vulnerabilities
Recent vulnerabilities recorded for opencart/opencart.
