| शीर्षक | opencart 4.1.0.3 Cross Site Scripting |
|---|
| विवरण | OpenCart x.x.x.x contains a stored cross-site scripting vulnerability in the admin order and return workflows. A normal front-office customer can store attacker-controlled HTML in profile fields such as firstname. When an administrator later uses the backend customer autocomplete workflow and selects the attacker-controlled customer, the stored value is decoded and injected into backend HTML without safe encoding, leading to JavaScript execution in the administrator browser. Administrator privileges are not required for the attacker; a normal customer account is sufficient. |
|---|
| स्रोत | ⚠️ https://github.com/Leousum/VulnPoC/blob/main/OpenCart_4.1.0.3/customer-name-stored-xss.md |
|---|
| उपयोगकर्ता | Leousum (UID 37212) |
|---|
| सबमिशन | 10/07/2026 11:38 AM (2 महीनों पहले) |
|---|
| संयम | 01/09/2026 09:18 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 397802 [OpenCart 4.1.0.3/4.1.0.4 Autocomplete Workflow edit.php firstname क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|