OpenCart 3.0.3.2 - Stored Cross Site Scripting (Authenticated)

vendor:

OpenCart

by:

Kailash Bohara

5.4

CVSS

MEDIUM

Stored Cross Site Scripting

CWE

Product Name: OpenCart

Affected Version From: OpenCart < 3.0.3.2

Affected Version To: OpenCart < 3.0.3.2

Patch Exists: YES

Related CWE: CVE-2020-10596

CPE: a:opencart:opencart

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: None

2020

OpenCart 3.0.3.2 – Stored Cross Site Scripting (Authenticated)

OpenCart versions prior to 3.0.3.2 are vulnerable to a stored cross-site scripting vulnerability. An authenticated attacker can exploit this vulnerability by uploading a malicious image file containing an XSS payload to the Image Manager section. This payload will be executed each time someone visits the Image Manager section.

Mitigation:

Upgrade to OpenCart version 3.0.3.2 or later.

Source

Exploit-DB raw data:

# Exploit Title: OpenCart 3.0.3.2 - Stored Cross Site Scripting (Authenticated)
# Date: 2020-06-01
# Exploit Author: Kailash Bohara
# Vendor Homepage: https://www.opencart.com
# Software Link: https://www.opencart.com/index.php?route=cms/download
# Version: OpenCart < 3.0.3.2
# CVE : CVE-2020-10596

1. Go to localhost.com/opencart/admin and login with credentials.

2. Then navigate to System>Users>Users and click on Action button on top right corner.

3. Now in image field , click on image and upload a new image. Before this select any image file and rename with this XSS payload "><svg onload=alert("XSS")> and then upload it as new user profile image.

4. After the upload completes the XSS pop-up executes as shown below and it will gets executed each time someone visits the Image manager section.