CVE-2021-47953: 
OpenCart vulnerability analysis and mitigation

CVE-2021-47953 is a Cross-Site Request Forgery (CSRF) vulnerability in OpenCart 3.0.3.7 that allows attackers to change authenticated users' passwords by sending crafted requests to the account/password endpoint. By tricking a logged-in user into submitting a hidden form containing attacker-controlled values in the password and confirm parameters, an attacker can hijack the victim's account. The vulnerability was published to the NVD and GitHub Advisory Database on May 10, 2026. It carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is insufficient CSRF token validation on the password-change endpoint (account/password) in OpenCart 3.0.3.7, classified as CWE-352 (Cross-Site Request Forgery). Because the application does not adequately verify that a password-change request was intentionally initiated by the authenticated user, an attacker can craft a malicious HTML page containing a hidden form that auto-submits a POST request with new password and confirm field values to the target endpoint. Exploitation requires that the victim be authenticated to their OpenCart account and visit the attacker-controlled page while their session is active. A public exploit entry exists on Exploit-DB (EDB-49970) (GitHub Advisory, VulnCheck Advisory).

Successful exploitation allows an attacker to silently change an authenticated user's password, effectively locking the legitimate user out of their account and granting the attacker full account control. This constitutes an account takeover with integrity impact on the affected user's profile and any data or orders associated with that account. Confidentiality impact is limited (no direct data exfiltration), and availability is not directly affected, but downstream consequences such as fraudulent orders or access to stored payment/address information are possible (GitHub Advisory).

A public exploit is referenced on Exploit-DB (EDB-49970), indicating that weaponized proof-of-concept code is publicly available (GitHub Advisory). However, there is currently no evidence of active in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.023–0.025% (7th percentile), reflecting a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Reconnaissance: Identify a target running OpenCart 3.0.3.7 by inspecting HTTP response headers, page footers, or version-disclosure endpoints common to OpenCart installations.
2. Craft malicious page: Create an HTML page containing a hidden auto-submitting form targeting the victim's OpenCart instance at https://<target>/index.php?route=account/password, with password and confirm fields set to the attacker's desired new password.
3. Deliver the payload: Distribute the malicious page link to the target user via phishing email, social media message, or by embedding it in a third-party site the victim is likely to visit while authenticated to OpenCart.
4. Trigger form submission: When the authenticated victim loads the attacker's page, the hidden form auto-submits via JavaScript (document.forms[0].submit()), sending a forged POST request with the victim's active session cookie.
5. Account takeover: The OpenCart server processes the request as legitimate, updates the victim's password to the attacker-controlled value, and the attacker can then log in to the victim's account using the new credentials (GitHub Advisory, VulnCheck Advisory).

• Logs: Unexpected POST requests to index.php?route=account/password originating from unusual IP addresses or referrer headers pointing to external/unknown domains in the web server access logs.
• Logs: Password change events in OpenCart's admin activity log for user accounts that the legitimate user did not initiate, particularly outside normal business hours.
• Network: HTTP POST requests to the account/password endpoint with a Referer header from an external or suspicious domain rather than the OpenCart site itself.
• Application: Users reporting sudden inability to log in with their existing credentials, indicating a password has been changed without their knowledge.

Update OpenCart to a version that includes CSRF token validation on the password-change endpoint; consult the GitHub Advisory (GHSA-fx8p-6qjq-9xvw) for patched version details, as specific fixed version numbers are not yet confirmed in the advisory (GitHub Advisory). As a configuration-level workaround, implement CSRF token validation on all authentication-sensitive form submissions and enforce strict Origin/Referer header checks on the account/password endpoint. Additionally, set the SameSite=Strict or SameSite=Lax attribute on session cookies to prevent cross-origin requests from carrying session credentials (VulnCheck Advisory).