CVE-2025-1747: OpenCart HTML Injection Vulnerability in Versions Prior to 4.1.0
Summary
CVE-2025-1747: HTML injection vulnerability in OpenCart. Affects opencart versions < 4.1.0. Fixed in 4.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCart is a popular open-source e-commerce platform that enables users to create and manage online stores. It offers a wide range of features including product management, payment processing, and customizable themes. However, certain versions of OpenCart prior to 4.1.0 are vulnerable to HTML injection attacks, which can compromise user security and data integrity.
Vulnerability Detail
The vulnerability arises from improper handling of user input in the login page of OpenCart. An attacker can exploit this by crafting a malicious URL that modifies the parameter name in the /account/login endpoint. This could lead to unauthorized manipulation of the HTML content rendered in the victim's browser, potentially allowing the attacker to execute scripts or steal sensitive information.
How To Fix
Minimum fixed version
4.1.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement input validation and sanitization on the /account/login endpoint to mitigate the risk of HTML injection until they can update to the patched version.
Conclusion
The HTML injection vulnerability identified as CVE-2025-1747 poses a significant risk to users of OpenCart versions prior to 4.1.0. It is crucial for users to update their installations to the latest version to protect against potential attacks. Additionally, implementing input validation can serve as a temporary measure until the update is completed.
See every vulnerability recorded for opencart →
FAQ
The vulnerability is an HTML injection issue that allows attackers to manipulate the HTML content of a user's browser.
OpenCart versions prior to 4.1.0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could lead to unauthorized access to sensitive information, data theft, or further attacks on users.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for opencart.
