CVE-2025-1747: OpenCart HTML Injection XSS Vulnerability

CVE-2025-1747 Overview

CVE-2025-1747 is an HTML injection vulnerability affecting OpenCart versions prior to 4.1.0. The flaw resides in the /account/login endpoint, where the parameter name is not properly sanitized before rendering. Attackers can craft a malicious URL that injects arbitrary HTML into the victim's browser when the link is opened. The issue is classified under CWE-79, which covers improper neutralization of input during web page generation. Successful exploitation requires user interaction, but no authentication is needed to launch the attack.

Critical Impact
Attackers can modify page content rendered in a victim's browser through a crafted login URL, enabling phishing, credential harvesting, and social engineering against OpenCart store users.

Affected Products

OpenCart versions prior to 4.1.0
Component: opencart:opencart
Vulnerable endpoint: /account/login

Discovery Timeline

2025-02-28 - CVE-2025-1747 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1747

Vulnerability Analysis

The vulnerability is an HTML injection flaw in the OpenCart e-commerce platform. It stems from insufficient output encoding of user-controlled input reflected on the /account/login page. An attacker crafts a URL that manipulates the parameter name so that arbitrary HTML markup is embedded in the server response. When a victim opens the link, the injected content renders inside the trusted OpenCart origin. This enables the attacker to alter the login page appearance, spoof form fields, or embed misleading messaging that facilitates phishing.

Root Cause

The root cause is missing sanitization of the parameter name handled by the login route. OpenCart reflects the parameter into the HTML response without applying context-appropriate encoding. Because the reflection occurs inside an HTML element context, unescaped characters such as < and > allow tag injection. The scope change reflected in the CVSS vector indicates the payload affects a security context beyond the vulnerable component itself, consistent with client-side content manipulation impacting the user's browser session.

Attack Vector

Exploitation requires an attacker to deliver a crafted /account/login URL to a victim, typically via email, chat, or a malicious referrer. When the victim clicks the link, the OpenCart server returns a page containing the injected HTML. The attacker does not need credentials or prior access. The rendered content appears on the legitimate OpenCart domain, giving the injected markup the trust of the store. Attackers commonly combine this technique with fake login prompts to capture credentials or redirect users to attacker-controlled infrastructure.

No verified public exploit code is available for this issue. Technical details are referenced in the INCIBE Security Advisory.

Detection Methods for CVE-2025-1747

Indicators of Compromise

Requests to /account/login containing HTML entities, angle brackets, or encoded tag sequences in parameter names.
Referrer headers pointing to external domains preceding /account/login requests with unusual query strings.
Web server logs showing repeated login page requests with abnormally long or malformed parameter names.

Detection Strategies

Inspect web application firewall (WAF) logs for reflected input patterns targeting the OpenCart login route.
Correlate outbound clicks from phishing emails with inbound requests to /account/login that contain suspicious query parameters.
Baseline expected parameter names on the login endpoint and alert on deviations or injected markup characters.

Monitoring Recommendations

Enable HTTP request and response body logging on the OpenCart front end for the /account/login path.
Monitor for spikes in traffic to the login page originating from unfamiliar referrers or short-lived campaigns.
Alert on Content Security Policy (CSP) violation reports that indicate injected inline content on OpenCart pages.

How to Mitigate CVE-2025-1747

Immediate Actions Required

Upgrade OpenCart to version 4.1.0 or later, which addresses the HTML injection in /account/login.
Audit existing OpenCart deployments to inventory all instances running versions prior to 4.1.0.
Notify store users of the risk of clicking unsolicited links pointing to their OpenCart login pages.

Patch Information

OpenCart resolved the issue in version 4.1.0. Administrators should follow the official upgrade procedure and validate that the login page correctly encodes reflected parameters after the update. Refer to the INCIBE Security Advisory for the complete list of OpenCart vulnerabilities addressed alongside CVE-2025-1747.

Workarounds

Deploy a WAF rule that blocks requests to /account/login containing HTML tag characters or encoded equivalents in parameter names.
Implement a strict Content Security Policy that disallows inline scripts and restricts framing to reduce injection impact.
Add server-side input validation in front of the OpenCart application to reject non-alphanumeric parameter names on authentication routes.

bash

# Example WAF rule (ModSecurity) to block HTML injection attempts on the login endpoint
SecRule REQUEST_URI "@beginsWith /account/login" \
  "phase:2,deny,status:403,id:1001747,\
  msg:'CVE-2025-1747 OpenCart HTML injection attempt',\
  chain"
  SecRule ARGS_NAMES|QUERY_STRING "@rx (<|%3C|>|%3E|script|onerror)" \
    "t:lowercase,t:urlDecodeUni"