Description

A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of the file catalog/controller/account/edit.php of the component Autocomplete Workflow. This manipulation of the argument firstname causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-02T02:17:20.270Z",
  "pubdate": "2026-09-02T02:17:20.270Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists within the Autocomplete Workflow component of OpenCart versions 4.1.0.3 and 4.1.0.4. This vulnerability resides in the catalog/controller/account/edit.php file and allows an unauthenticated or authenticated attacker to inject malicious client-side scripts into the application. By manipulating the 'firstname' argument, an attacker can execute arbitrary JavaScript in the context of a victim's browser session. The primary risk associated with this vulnerability is the potential for session hijacking, credential theft, and unauthorized actions performed on behalf of the user. Because the flaw is exploitable remotely and relies on improper sanitization of user-supplied input, it poses a significant threat to data integrity and user privacy. Despite early notification, the vendor has not addressed the vulnerability, leaving affected deployments exposed to public exploits.",
  "technicalDetails": "The vulnerability is identified as a Stored or Reflected Cross-Site Scripting (XSS) flaw located within the 'catalog/controller/account/edit.php' file of the OpenCart 4.1.0.3/4.1.0.4 framework. The root cause of this vulnerability is the inadequate sanitization and validation of the 'firstname' input parameter before it is processed by the Autocomplete Workflow component and subsequently reflected back to the end-user's browser. In a typical attack flow, the attacker identifies that the application fails to encode special characters (such as '<', '>', '\"', or ''') within the 'firstname' field. By submitting a crafted payload—such as '<script>alert(document.cookie)</script>'—into the affected parameter, the attacker can force the application to render the malicious script within the HTML response sent to the client. When an affected user interacts with the application, the browser interprets the injected script as legitimate code, leading to execution in the security context of the origin site. This allows the attacker to bypass Same-Origin Policy (SOP) protections, steal session cookies, capture sensitive form data, or redirect users to malicious third-party domains. Since the vulnerability is remotely exploitable, attackers can target any user session that triggers the vulnerable component. The lack of output encoding prevents the browser from distinguishing between intended application content and injected malicious scripts. Given that this is a client-side execution vulnerability, the impact is primarily localized to the user's browser environment, yet the persistence or ease of triggering this reflection can facilitate widespread compromise. Without vendor-supplied patches, the application remains susceptible to automated exploitation techniques utilized by malicious actors who monitor public disclosure repositories."
}