CVE-2021-47953: OpenCart 3.0.3.7 CSRF Vulnerability

CVE-2021-47953 Overview

CVE-2021-47953 is a cross-site request forgery (CSRF) vulnerability in OpenCart 3.0.3.7. The flaw resides in the account/password endpoint, which fails to validate the origin of password change requests. Attackers can craft a malicious HTML page that submits a hidden form containing password and confirm parameters. When an authenticated OpenCart user visits the attacker-controlled page, the browser silently submits the form and changes the victim's password. The attacker then logs in with the new credentials and hijacks the account. The vulnerability is classified under CWE-352: Cross-Site Request Forgery.

Critical Impact

Authenticated OpenCart users can have their account passwords silently changed by visiting an attacker-controlled page, leading to full account takeover.

Affected Products

• OpenCart 3.0.3.7
• OpenCart 3.x branch installations using the default account password handler
• Storefront deployments exposing index.php?route=account/password

Discovery Timeline

• 2026-05-10 - CVE-2021-47953 published to NVD
• 2026-05-12 - Last updated in NVD database

Technical Details for CVE-2021-47953

Vulnerability Analysis

The vulnerability resides in OpenCart's account password change workflow. The account/password controller processes POST requests containing password and confirm parameters but does not enforce an anti-CSRF token. Any authenticated session that submits a properly formed POST to this endpoint will update the user's credentials. Browsers automatically attach session cookies to cross-origin form submissions, which is the foundation of the CSRF attack class [CWE-352].

Successful exploitation requires the victim to be logged in to the OpenCart storefront and to visit a page controlled by the attacker. The attacker does not need credentials, network position, or interaction beyond a normal page visit. Once the password is changed, the attacker authenticates with the new value and takes over the account, accessing order history, saved addresses, and stored payment metadata.

Root Cause

The root cause is the absence of a synchronizer token or equivalent state-changing-request protection on the password update form. OpenCart 3.0.3.7 relies solely on the session cookie for authentication, treating any POST with valid session context as legitimate. The controller does not verify the Origin or Referer header and does not require re-entry of the current password before applying the new one.

Attack Vector

The attack is delivered over the network through a malicious web page, email link, or compromised third-party site. The attacker hosts an HTML document containing a hidden form that targets the victim's OpenCart instance. The form auto-submits via JavaScript on page load, sending password and confirm field values to index.php?route=account/password. Because the request is cross-origin but credentialed, OpenCart processes it as a legitimate update from the authenticated user.

The vulnerability mechanism is documented in the Exploit-DB advisory #49970 and the VulnCheck Advisory. No additional privileges or user interaction beyond visiting a page are required.

Detection Methods for CVE-2021-47953

Indicators of Compromise

• POST requests to index.php?route=account/password with Referer headers pointing to external or unexpected domains
• Password change events immediately followed by login attempts from a new IP address or user agent
• Web server logs showing repeated cross-origin POSTs to the account password endpoint within short time windows

Detection Strategies

• Inspect HTTP access logs for password endpoint requests lacking a same-origin Referer or with mismatched Origin headers
• Correlate password change events in the OpenCart database oc_customer table with subsequent session establishment from new geolocations
• Deploy a web application firewall rule that flags POSTs to account/password missing a CSRF token parameter

Monitoring Recommendations

• Alert on bursts of account password changes across multiple customer accounts within a short window
• Monitor outbound referrer patterns in HTTP logs to identify users redirected from suspicious third-party domains before submitting credentials
• Track failed login attempts immediately preceded by password changes, which indicate testing of hijacked accounts

How to Mitigate CVE-2021-47953

Immediate Actions Required

• Upgrade OpenCart to a version that implements CSRF tokens on the account password endpoint
• Apply a web application firewall rule enforcing same-origin Referer checks on POSTs to account/password
• Force a password reset for all existing customer accounts to invalidate any silently changed credentials

Patch Information

No vendor patch URL is listed in the enriched CVE data. Administrators should consult the VulnCheck Advisory and the OpenCart project repository for the latest fixed release. Until an upgrade is deployed, custom modifications to the catalog/controller/account/password.php controller can introduce a synchronizer token validated against the user session.

Workarounds

• Add a hidden CSRF token field to the password change form and validate it server-side before updating credentials
• Require the current password as an additional field on the password change form to prevent silent updates
• Configure the session cookie with the SameSite=Strict attribute to block cross-site credentialed POST submissions
• Restrict access to the storefront account area using network-level controls where feasible for B2B deployments

# Example Nginx rule blocking cross-origin POSTs to the password endpoint
location = /index.php {
    if ($request_method = POST) {
        set $block 0;
        if ($arg_route = "account/password") { set $block "${block}1"; }
        if ($http_referer !~* "^https://your-store\.example\.com/") { set $block "${block}1"; }
        if ($block = "011") { return 403; }
    }
    include fastcgi_params;
}