CVE-2025-1746: OpenCart XSS Vulnerability in Search

CVE-2025-1746 Overview

CVE-2025-1746 is a reflected Cross-Site Scripting (XSS) vulnerability affecting OpenCart versions prior to 4.1.0. The flaw resides in the /product/search endpoint, where user-supplied search input is reflected in the response without proper output encoding. An attacker can craft a malicious URL containing JavaScript payloads and deliver it to victims through phishing or social engineering. When a victim clicks the link, the injected script executes in the context of the OpenCart site. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Attackers can execute arbitrary JavaScript in victims' browsers, enabling session cookie theft, credential harvesting, and unauthorized actions performed on behalf of authenticated users.

Affected Products

OpenCart versions prior to 4.1.0
OpenCart /product/search endpoint
Storefronts running vulnerable OpenCart deployments

Discovery Timeline

2025-02-28 - CVE-2025-1746 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1746

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the OpenCart storefront search functionality. The /product/search endpoint accepts a search query parameter and echoes the user-supplied value back into the rendered HTML response. Because the application fails to sanitize or HTML-encode the input, attacker-supplied markup is interpreted as executable content by the browser.

Reflected XSS requires user interaction, typically through a crafted link delivered via email, chat, or a compromised third-party site. Once the victim visits the URL, the payload runs in the same origin as the OpenCart site, granting the attacker access to session cookies, local storage, and the ability to issue authenticated requests. The EPSS probability of 0.215% (percentile 11.99) indicates limited observed exploitation interest at this time.

Root Cause

The root cause is improper neutralization of input during web page generation. The search parameter is placed directly into the HTML response without contextual encoding. There is no allowlist filter, no HTML entity escaping, and no Content Security Policy (CSP) enforcement that would block inline script execution.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker constructs a URL pointing to the vulnerable OpenCart storefront's /product/search endpoint with a JavaScript payload embedded in the search parameter. The victim receives and clicks the link. The server reflects the payload into the rendered page, and the browser executes it under the OpenCart origin. Because the scope is changed, the injected script can affect resources beyond the vulnerable component, such as authenticated session data.

Since no verified proof-of-concept code is publicly available, refer to the INCIBE Security Advisory for additional technical detail.

Detection Methods for CVE-2025-1746

Indicators of Compromise

Web server access logs containing requests to /product/search with query parameters embedding <script>, javascript:, onerror=, or onload= strings.
URL-encoded payloads in the search parameter such as %3Cscript%3E or %3Cimg.
Unusual referrers pointing to external phishing domains preceding requests to the search endpoint.
Spikes in outbound requests from user sessions to unfamiliar domains immediately after search endpoint activity.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule to inspect and block script-like patterns in query parameters targeting /product/search.
Enable server-side logging of the full query string for the storefront search route and alert on payloads matching XSS signatures.
Correlate authentication events with search endpoint requests to detect session hijacking that follows a reflected XSS click.

Monitoring Recommendations

Monitor Content Security Policy (CSP) violation reports for inline script execution attempts on the storefront.
Track outbound HTTP requests from user browsers to non-approved domains that could indicate cookie exfiltration.
Review administrator session activity for anomalous IP addresses or geolocations that could signal stolen session tokens.

How to Mitigate CVE-2025-1746

Immediate Actions Required

Upgrade OpenCart to version 4.1.0 or later on all storefront instances.
Rotate active administrator and customer session cookies after patching to invalidate any tokens harvested pre-patch.
Audit web server logs for suspicious requests to /product/search predating the patch and investigate any confirmed exploitation.

Patch Information

OpenCart has addressed the vulnerability in version 4.1.0. Administrators should download the latest release from the official OpenCart project and apply it following the vendor's upgrade documentation. See the INCIBE Security Advisory for further guidance.

Workarounds

Deploy a WAF signature that blocks requests to /product/search containing HTML tags, javascript: URIs, or common XSS event handlers.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Set the HttpOnly and Secure flags on session cookies to reduce impact of cookie theft via XSS.
Configure the SameSite=Strict cookie attribute to limit cross-site request forgery follow-on attacks.

bash

# Example nginx configuration to enforce a restrictive CSP header
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;