Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.2

OpenCart 4.0.2.3 theme editor can run unwanted code

published 1 year ago
Summary

The theme editor in OpenCart version 4.0.2.3 can be tricked into executing malicious code on the server. This could let an attacker take control of the website or steal data. Update OpenCart to a patched version or apply the vendor's recommended fix as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
Packagist opencart opencart/opencart <= 4.0.2.3
Original advisory text
Duplicate Advisory: openCart Server-Side Template Injection (SSTI) vulnerability
## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-xrh7-2gfq-4rcq. This link is maintained to preserve external references.

## Original Description
OpenCart 4.0.2.3 is vulnerable to Server-Side Template Injection (SSTI) via the Theme Editor Function.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
7.2 High
Type
CWE-94Code Injection
Timeline
Published18 Dec 2024
Updated10 Sep 2026
First seen10 Sep 2026
Sources
GHSA-j2v2-3784-vr44 · OSV
Track software like this
Free during beta