CVE-2021-47923: 
OpenCart vulnerability analysis and mitigation

CVE-2021-47923 is a session fixation vulnerability in OpenCart 3.0.3.8 that allows unauthenticated remote attackers to hijack user sessions by injecting arbitrary values into the OCSESSID cookie. The server accepts and maintains attacker-supplied session identifiers, enabling unauthorized account takeover without user interaction. The vulnerability was published to the NVD and GitHub Advisory Database on May 10, 2026, and is assigned a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.3 (Critical) (GitHub Advisory, VulnCheck).

The root cause is improper session management classified under CWE-290 (Authentication Bypass by Spoofing): OpenCart 3.0.3.8 fails to validate or regenerate the OCSESSID session cookie upon authentication, allowing an attacker to pre-set a known session identifier that the server will subsequently associate with a legitimate user's authenticated session. The attack vector is entirely network-based, requires no privileges, no user interaction, and no special preconditions beyond the ability to set a cookie value in a request to the target application. A public exploit is referenced on Exploit-DB (EDB-50555), suggesting the mechanics of the attack are publicly documented (GitHub Advisory, VulnCheck).

Successful exploitation allows an unauthenticated attacker to fully take over authenticated user sessions, gaining the ability to read sensitive account data (e.g., personal information, order history, saved payment details), modify account settings, and perform any action available to the compromised user. In e-commerce contexts, this could result in fraudulent orders, data theft, and exposure of customer PII. Administrative accounts are equally at risk, potentially enabling full store compromise (GitHub Advisory, VulnCheck).

A public exploit is available on Exploit-DB (EDB-50555), indicating the vulnerability is weaponizable with publicly accessible tooling (GitHub Advisory). The EPSS score is approximately 0.052–0.068%, placing it in the 21st percentile for near-term exploitation probability. There is no current evidence of active in-the-wild exploitation or threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Reconnaissance: Identify OpenCart 3.0.3.8 instances using web fingerprinting tools (e.g., Wappalyzer, Shodan) by looking for the OpenCart-specific OCSESSID cookie in HTTP responses.
2. Generate a known session value: Choose or generate an arbitrary string to use as the session identifier (e.g., attacker_controlled_session_id).
3. Inject the session cookie: Send an HTTP request to the target OpenCart store with the crafted OCSESSID cookie value set (e.g., via curl --cookie "OCSESSID=attacker_controlled_session_id" https://target-store.com/).
4. Deliver the session to a victim: Trick a legitimate user into making a request to the OpenCart store with the same OCSESSID value (e.g., via a phishing link, XSS, or man-in-the-middle attack that injects the cookie).
5. Wait for victim authentication: Once the victim logs in using the attacker-supplied session ID, the server associates the authenticated session with that known identifier.
6. Hijack the session: Use the same OCSESSID value in subsequent requests to the store, gaining full access to the victim's authenticated session and account (GitHub Advisory, VulnCheck).

• Network: HTTP requests to the OpenCart store containing an OCSESSID cookie value that was not issued by the server (i.e., not present in prior server Set-Cookie headers); multiple requests from different IP addresses using the same OCSESSID value.
• Logs: Web server access logs showing the same OCSESSID cookie value appearing from two distinct IP addresses — one unauthenticated and one authenticated; login events followed immediately by account actions from a geographically or behaviorally anomalous IP.
• Application Behavior: Unexpected account changes (email, password, shipping address modifications) shortly after login; orders placed from unfamiliar IP addresses associated with a known user session.

The GitHub Advisory (GHSA-5hhh-fq62-xfww) references a patch, though specific fixed version numbers are not yet confirmed in the advisory. Administrators should update OpenCart to the latest available version and verify that session tokens are regenerated upon authentication. As interim mitigations, enforce secure cookie flags (HttpOnly, Secure, SameSite=Strict) on the OCSESSID cookie, implement server-side session validation (e.g., binding sessions to IP address or user-agent), and monitor for anomalous session reuse patterns. Refer to the VulnCheck advisory for the latest patch guidance (GitHub Advisory, VulnCheck).

Coverage of CVE-2021-47923 has been limited to automated vulnerability database aggregators (NVD, VulDB, Vulners) and a brief mention on Bluesky via a CVE notification bot. No notable researcher commentary, vendor blog posts, or significant media coverage has been identified at this time (GitHub Advisory).