CVE-2025-1116: Dreamvention Live AJAX Search SQL Injection

CVE-2025-1116 Overview

CVE-2025-1116 is a SQL injection vulnerability in the Dreamvention Live AJAX Search Free extension for OpenCart, affecting versions up to 1.0.6. The flaw resides in the searchresults/search function exposed through /?route=extension/live_search/module/live_search.searchresults. Attackers manipulate the keyword parameter to inject arbitrary SQL statements into backend database queries. The vulnerability is remotely exploitable without authentication or user interaction. Public exploit code has been disclosed, increasing the risk of opportunistic attacks against OpenCart storefronts running the affected extension.

Critical Impact

Unauthenticated remote attackers can inject SQL commands via the keyword parameter, exposing OpenCart database contents including customer data and credentials.

Affected Products

• Dreamvention Live AJAX Search Free for OpenCart, versions up to and including 1.0.6
• OpenCart storefronts with the live_search module installed and enabled
• Endpoints exposing /?route=extension/live_search/module/live_search.searchresults

Discovery Timeline

• 2025-02-08 - CVE-2025-1116 published to the National Vulnerability Database (NVD)
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-1116

Vulnerability Analysis

The vulnerability is a SQL injection flaw categorized under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The affected function searchresults/search processes the keyword query parameter without proper sanitization or parameterized query handling. An attacker submits crafted input through the HTTP request to the live search endpoint, and the application concatenates that input directly into a database query. The injected SQL then executes within the OpenCart database context.

Successful exploitation enables data extraction from product catalogs, order tables, and customer records. Depending on database privileges, attackers may also modify records or pivot to further attacks against the underlying server. Because the live search endpoint is intended for unauthenticated storefront visitors, no credentials or session state are required.

Root Cause

The root cause is missing input validation and the absence of prepared statements in the live_search.searchresults handler. User-controlled keyword data flows directly into a SQL query string, allowing attacker-supplied operators, comments, and UNION clauses to alter query semantics.

Attack Vector

The attack vector is network-based. An attacker issues an HTTP GET or POST request to /?route=extension/live_search/module/live_search.searchresults with a malicious value in the keyword parameter. The exploit details have been published publicly, including a GitHub Gist documenting the proof of concept. See the GitHub Gist Exploit Code and VulDB entry #295022 for technical specifics on the injection payload structure.

Detection Methods for CVE-2025-1116

Indicators of Compromise

• HTTP requests to /?route=extension/live_search/module/live_search.searchresults containing SQL meta-characters such as single quotes, UNION, SELECT, --, or /* in the keyword parameter
• Web server access logs showing repeated requests to the live search endpoint with abnormally long or encoded keyword values
• Database error messages or HTTP 500 responses correlated with live search queries
• Outbound database connections or unusual SELECT activity targeting oc_customer, oc_user, or order tables

Detection Strategies

• Deploy WAF rules that inspect the keyword parameter on the live_search route for SQL injection signatures
• Enable MySQL general query logging temporarily to capture queries containing attacker-controlled keyword tokens
• Correlate web access logs with database audit logs to identify anomalous query patterns originating from the live search module
• Hunt for repeated boolean-based or time-based injection patterns such as AND 1=1, SLEEP(, or BENCHMARK( in HTTP query strings

Monitoring Recommendations

• Alert on any non-alphanumeric characters beyond expected search punctuation in the keyword parameter
• Monitor request rates to the live_search.searchresults route and flag spikes from single source IPs
• Track outbound data volume from the OpenCart database server for signs of bulk extraction
• Review authentication and admin panel logs for follow-on activity after suspected injection attempts

How to Mitigate CVE-2025-1116

Immediate Actions Required

• Disable the Dreamvention Live AJAX Search Free extension in the OpenCart admin panel until a patched version is confirmed available
• Block requests to /?route=extension/live_search/module/live_search.searchresults at the WAF or reverse proxy if the module cannot be disabled immediately
• Rotate database credentials and review accounts for any unauthorized changes following suspected exploitation
• Audit web logs for prior exploitation attempts going back to the publication date

Patch Information

No vendor patch has been confirmed in the enriched CVE data at the time of writing. Administrators should consult the Dreamvention extension page on the OpenCart marketplace for updates and apply any version released after 1.0.6. Verify fix availability through the VulDB advisory and vendor channels before redeploying the module.

Workarounds

• Remove or uncheck the live_search module from the OpenCart extension configuration to eliminate the vulnerable route
• Deploy a WAF rule that rejects requests containing SQL meta-characters in the keyword parameter on the live search endpoint
• Restrict database account privileges used by OpenCart to read-only on non-essential tables to limit injection impact
• Apply rate limiting on the live search endpoint to slow automated exploitation attempts

# Example ModSecurity rule blocking SQL injection in the keyword parameter
SecRule REQUEST_URI "@contains /?route=extension/live_search/module/live_search.searchresults" \
    "chain,phase:2,deny,status:403,id:1000116,msg:'CVE-2025-1116 SQLi attempt'"
    SecRule ARGS:keyword "@rx (?i)(union\s+select|sleep\s*\(|benchmark\s*\(|--|/\*|;\s*drop)" \
        "t:none,t:urlDecodeUni"