Description

A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown function of the file catalog/controller/account/address.php of the component Autocomplete Workflow. The manipulation of the argument address_1 results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-02T02:17:20.087Z",
  "pubdate": "2026-09-02T02:17:20.087Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists within the Autocomplete Workflow component of OpenCart versions 4.1.0.3 and 4.1.0.4.\nThe vulnerability resides in the catalog/controller/account/address.php file, where the 'address_1' input parameter fails to undergo adequate sanitization or output encoding.\nThis security flaw allows a remote, unauthenticated or authenticated attacker to inject malicious scripts into the web application, which are then executed within the context of a victim's browser session.\nSuccessful exploitation can result in session hijacking, unauthorized actions performed on behalf of the user, theft of sensitive session cookies, or the redirection of users to malicious third-party websites.\nGiven that the vulnerability is publicly disclosed and the vendor has not provided a formal response or patch, the risk profile is elevated.\nOrganizations utilizing the affected versions should implement immediate compensatory controls to prevent unauthorized script execution.",
  "technicalDetails": "The vulnerability is classified as a Reflected Cross-Site Scripting (XSS) flaw, stemming from the insecure handling of user-supplied input within the 'autocomplete' functionality of the address management module.\nSpecifically, the file catalog/controller/account/address.php processes the 'address_1' parameter intended for the Autocomplete Workflow. The application fails to perform necessary server-side validation or output escaping before rendering this input back to the user interface.\nThe attack flow begins when an attacker crafts a malicious URL containing a payload within the 'address_1' argument. When a victim interacts with this crafted link, the malicious script is reflected by the OpenCart server and executed within the victim's browser.\nBecause the application reflects the 'address_1' input directly, an attacker can bypass standard browser-side filters if the input is not contextually encoded. The payload is interpreted as active content rather than plain text, allowing for arbitrary JavaScript execution.\nIn a typical attack scenario, the payload might include functions designed to access 'document.cookie' to exfiltrate session tokens to an attacker-controlled listener. Alternatively, the script can be used to manipulate the DOM, perform unauthorized state-changing requests (CSRF), or capture sensitive input data entered by the user.\nSince the vulnerability exists within the 'autocomplete' workflow, it is accessible remotely and does not require elevated administrative privileges to initiate, assuming the victim can be coerced into visiting the crafted URL.\nThe root cause is an improper neutralization of input during the generation of dynamic web pages. The lack of strict content security policies (CSP) or robust input sanitization routines in the identified controller allows for the injection of `<script>` tags and other XSS-related vectors.\nThis vulnerability effectively compromises the integrity and confidentiality of the user session, as the malicious code inherits the same-origin privileges of the OpenCart application session."
}