CVE-2021-47923: OpenCart Session Fixation Vulnerability

CVE-2021-47923 Overview

CVE-2021-47923 is a session fixation vulnerability in OpenCart 3.0.3.8, an open-source e-commerce platform. The flaw allows attackers to inject arbitrary values into the OCSESSID cookie. The server accepts and maintains these attacker-supplied session identifiers without regeneration. An attacker who tricks a victim into using a known OCSESSID value can hijack the authenticated session once the victim logs in. This results in account takeover and unauthorized access to user data and order history. The weakness is classified under CWE-290: Authentication Bypass by Spoofing.

Critical Impact

Network-based attackers can hijack authenticated user sessions and access victim accounts without credentials by pre-setting the OCSESSID cookie value.

Affected Products

• OpenCart 3.0.3.8
• OpenCart 3.x branch installations using default session handling
• Web storefronts relying on the OCSESSID cookie for session state

Discovery Timeline

• 2026-05-10 - CVE-2021-47923 published to NVD
• 2026-05-12 - Last updated in NVD database

Technical Details for CVE-2021-47923

Vulnerability Analysis

OpenCart 3.0.3.8 issues session identifiers through the OCSESSID cookie. The application accepts a client-supplied OCSESSID value and binds the subsequent authentication state to that identifier. The server does not regenerate the session identifier after a successful login. Any session ID an attacker plants in the victim's browser becomes a valid authenticated session once the victim signs in.

This matches the classic session fixation pattern. The attacker controls the session token before authentication occurs, then reuses that same token after the victim authenticates. Because OpenCart trusts arbitrary OCSESSID values without rotating them at privilege boundaries, the attacker and victim end up sharing the same authenticated session context.

Root Cause

The root cause is the absence of session identifier regeneration during authentication state changes. Secure session management requires invalidating any pre-login session token and issuing a fresh, server-generated identifier upon login. OpenCart 3.0.3.8 instead persists the existing OCSESSID across the authentication boundary, satisfying the conditions described in [CWE-290].

Attack Vector

The attack is network-reachable and requires no privileges. An attacker first obtains a valid OCSESSID value from the target OpenCart instance. The attacker then forces this value into the victim's browser through cross-site scripting on a related domain, a man-in-the-middle injection over unencrypted channels, or a crafted link that sets the cookie via subdomain abuse. When the victim authenticates to OpenCart, the attacker reuses the same OCSESSID to issue requests as the authenticated user. Public exploitation details are documented in Exploit-DB #50555 and the VulnCheck Advisory.

Detection Methods for CVE-2021-47923

Indicators of Compromise

• Multiple distinct source IP addresses or User-Agent strings reusing the same OCSESSID cookie value within a short time window.
• OCSESSID values appearing in HTTP request logs before any corresponding Set-Cookie response from the server.
• Authenticated actions such as address changes, order placements, or profile edits originating from a session that was previously unauthenticated under the same identifier.

Detection Strategies

• Inspect web server and reverse proxy logs for OCSESSID cookies that persist unchanged across login transitions for the same user account.
• Correlate authentication events with session token rotation. Flag accounts where the session identifier does not change at login.
• Deploy web application firewall rules that detect injection of OCSESSID through URL parameters or referrer-based cookie planting.

Monitoring Recommendations

• Enable verbose access logging on the OpenCart frontend and admin endpoints, capturing full cookie headers for forensic review.
• Alert on concurrent active sessions sharing identical OCSESSID values from geographically distant source IPs.
• Monitor administrative account activity for session identifiers that predate the login event timestamp.

How to Mitigate CVE-2021-47923

Immediate Actions Required

• Upgrade OpenCart to a release later than 3.0.3.8 that addresses session handling, or apply community patches that force session_regenerate_id() on login.
• Invalidate all existing customer and administrator sessions and require re-authentication.
• Enforce the HttpOnly, Secure, and SameSite=Lax attributes on the OCSESSID cookie.

Patch Information

No vendor advisory URL is listed in the enriched data. Administrators should consult the OpenCart Official Site for the latest release notes and verify that session identifiers are regenerated during login. Reference exploitation and remediation context is available in the VulnCheck Advisory.

Workarounds

• Modify the authentication controller to call PHP's session_regenerate_id(true) immediately after a successful customer or admin login.
• Reject inbound OCSESSID cookies that do not match a server-generated identifier already tracked in the session store.
• Serve OpenCart exclusively over HTTPS and enable HTTP Strict Transport Security to prevent cookie injection over plaintext channels.

# Configuration example: enforce secure cookie attributes in php.ini
session.cookie_httponly = 1
session.cookie_secure = 1
session.cookie_samesite = "Lax"
session.use_strict_mode = 1
session.use_only_cookies = 1