Executive brief
OpenCart is a popular open-source e-commerce platform used by online retailers to manage product catalogs and customer orders. A vulnerability in the customer address handling allows an unauthenticated attacker or a regular customer to inject malicious HTML/JavaScript into address fields, which is later executed in an administrator's browser when they access the order management interface. An attacker could exploit this to steal admin session tokens, modify orders, or compromise customer data.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in OpenCart 4.1.0.3 and 4.1.0.4, specifically in the customer address autocomplete workflow. A regular front-office customer can inject attacker-controlled HTML into the address_1 field via catalog/controller/account/address.php. The malicious payload is stored in the database and later returned by the backend autocomplete API (admin/controller/customer/customer.php). When an administrator opens the order creation/editing page, the admin interface decodes HTML entities and concatenates the stored address values directly into a select dropdown using raw HTML injection (admin/view/template/sale/order_info.twig), allowing the injected script to execute in the admin's browser. No special privileges or user interaction is required beyond a standard login. Patches are expected from the vendor, though early disclosure notifications went unanswered.
Affected products
- OpenCart OpenCart 4.1.0.3, 4.1.0.4
Timeline
- 2026-09-02: disclosed
- other: Exploit proof-of-concept published publicly