CVE-2026-84437: 
OpenCart vulnerability analysis and mitigation

CVE-2026-84437 is a stored cross-site scripting (XSS) vulnerability in OpenCart versions 4.1.0.3 and 4.1.0.4, affecting the catalog/controller/account/address.php file within the Autocomplete Workflow component. A low-privileged, authenticated front-office customer can inject malicious HTML/JavaScript into the address_1 argument, which is later rendered unsanitized in the administrator's browser during order management workflows. The vulnerability was disclosed on September 2, 2026, with a public proof-of-concept available; the vendor did not respond to early disclosure attempts. It carries a CVSS v3.1 base score of 3.5 (Low) and a CVSS v4.0 base score of 2.0 (Low) (Github Advisory, VulDB).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), with a secondary classification of CWE-94 (Improper Control of Code Generation). The vulnerable data flow begins when a customer saves an address via catalog/controller/account/address.php (lines 309/397), which persists attacker-controlled data into the oc_address database table via catalog/model/account/address.php. When an administrator opens an order creation or edit page, the backend autocomplete at admin/controller/customer/customer.php returns the stored address records; the Twig template admin/view/template/sale/order_info.twig then passes the address_1 value through decodeHTMLEntities() and concatenates it into a raw HTML string, which is injected into the DOM via $('#input-payment-address').html(html) — allowing stored payloads to execute as active JavaScript in the admin context. A public PoC demonstrating the full attack chain is available (PoC Write-up).

Successful exploitation allows a low-privileged customer to execute arbitrary JavaScript in an administrator's browser session, enabling administrator session token theft, unauthorized admin-side action execution (such as modifying orders or customer data), and full compromise of order handling and customer management workflows. While confidentiality impact on the vulnerable system itself is rated None (no direct data leakage from the XSS endpoint), the practical consequence of admin session hijacking can lead to complete store takeover. Availability is not directly impacted (Github Advisory, PoC Write-up).

A public proof-of-concept is available in the researcher's GitHub repository, demonstrating the full stored XSS attack chain (PoC Write-up). The CVSS v4.0 exploit maturity is rated "Proof of Concept." The EPSS score is approximately 0.191% (9th percentile), indicating a low but non-negligible probability of exploitation in the wild within 30 days. No evidence of active in-the-wild exploitation or threat actor attribution has been reported, and the vulnerability is not listed in the CISA KEV catalog (Github Advisory, VulDB).

1. Create a customer account: Register or log in as a normal front-office customer on the target OpenCart 4.1.0.3/4.1.0.4 store.
2. Inject XSS payload into address field: Navigate to the address management page (/index.php?route=account/address.form&language=en-gb) and set the address_1 field to a malicious payload such as <img src=x onerror=alert(document.cookie)> or a more sophisticated payload to exfiltrate the admin session cookie.
3. Save the address: Submit the form; the payload is stored in the oc_address database table without sanitization via catalog/model/account/address.php.
4. Wait for admin interaction: The payload triggers when an administrator opens an order creation or edit page (/admin/index.php?route=sale/order.info) and uses the customer search/autocomplete to select the attacker's account.
5. Payload execution: The backend autocomplete returns the stored address_1 value; the frontend template decodes HTML entities and injects the value into the DOM via .html(), causing the script to execute in the administrator's browser context.
6. Session hijack or further exploitation: The executed script can exfiltrate the admin's session cookie to an attacker-controlled server, enabling full administrative access to the OpenCart backend (PoC Write-up).

• Network: Outbound HTTP requests from the administrator's browser to unexpected external domains or IP addresses immediately after interacting with the customer autocomplete on order pages; unusual POST requests to attacker-controlled endpoints containing cookie or session data.
• Logs: OpenCart access logs showing customer address save requests (POST /index.php?route=account/address.save) with HTML/JavaScript content in the address_1 parameter; admin panel access logs showing order info page loads followed by anomalous external requests.
• Database: Entries in the oc_address table where the address_1 column contains HTML tags or JavaScript (e.g., <script>, <img src=x onerror=, javascript:) rather than plain text address data.
• File System: No direct file system artifacts expected for this XSS vector, but check for newly created admin accounts or modified store settings that may indicate post-exploitation activity.

OpenCart has not publicly issued a patched version in response to this disclosure, and the vendor did not respond to the researcher's contact attempts; the GitHub Advisory lists affected versions as 4.1.0.3 and 4.1.0.4 with no confirmed patched version (Github Advisory). As immediate mitigations, administrators should implement strict input validation and output encoding for the address_1 parameter in both catalog/controller/account/address.php and the admin Twig templates, replacing .html() with .text() where raw HTML rendering is not required. Deploying a Web Application Firewall (WAF) with XSS filtering rules can help block malicious payloads until a vendor patch is available. Additionally, restricting customer registration or requiring manual approval for new accounts can reduce the attack surface.

The vulnerability was reported by researcher Leousum with a detailed public PoC write-up on GitHub, and the CVE was assigned via VulDB. The OpenCart vendor did not respond to early disclosure attempts, which was noted in the advisory. No significant broader media coverage or notable security community commentary beyond the initial disclosure and automated vulnerability database aggregation has been identified.