CVE-2025-1749: OpenCart XSS Vulnerability

CVE-2025-1749 Overview

CVE-2025-1749 is an HTML injection vulnerability affecting OpenCart versions prior to 4.1.0. The flaw resides in the /account/voucher endpoint, where the parameter name is not properly sanitized before rendering. An attacker can craft a malicious URL that, once clicked by an authenticated user, injects arbitrary HTML content into the victim's browser session. The issue is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Attackers can manipulate rendered page content to conduct phishing, credential harvesting, or brand impersonation against OpenCart storefront users.

Affected Products

OpenCart versions prior to 4.1.0
OpenCart storefront /account/voucher module
Deployments exposing the vulnerable parameter name handling

Discovery Timeline

2025-02-28 - CVE-2025-1749 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1749

Vulnerability Analysis

The vulnerability stems from insufficient output encoding in the OpenCart storefront voucher module. The application reflects user-supplied parameter names from the /account/voucher request directly into the HTML response. Because the framework does not neutralize HTML control characters, an attacker can inject markup that the browser renders as legitimate content.

Exploitation requires user interaction. The victim must follow a crafted URL supplied by the attacker. The scope change reflected in the CVSS vector indicates the injected content can affect resources beyond the vulnerable component boundary, such as embedded frames or trust context within the storefront.

While the flaw does not permit script execution in the classic reflected XSS sense, injected HTML can render fake login forms, redirect users through anchor tags, or overlay branded phishing content. Confidentiality of stored data is unaffected, but integrity of the rendered page is compromised.

Root Cause

The root cause is missing input validation and output encoding on the parameter name processed by the voucher endpoint. OpenCart concatenates untrusted request data into HTML output without applying context-aware escaping such as htmlspecialchars() with the appropriate flags. This aligns with the [CWE-79] weakness pattern.

Attack Vector

The attack is network-based and requires no privileges. An attacker distributes a malicious URL targeting /account/voucher with a manipulated parameter name containing HTML markup. Delivery typically occurs through phishing email, chat platforms, or attacker-controlled sites. When the victim clicks the link while browsing an affected OpenCart instance, the injected markup renders inline within the trusted storefront context.

Refer to the INCIBE Early Warning Advisory for additional technical detail on the affected parameter and reproduction conditions.

Detection Methods for CVE-2025-1749

Indicators of Compromise

Web server access logs showing requests to /account/voucher with parameter names containing HTML tags such as <, >, <img, or <a href
URL-encoded payloads (%3C, %3E, %22) appearing in query strings targeting the voucher endpoint
Referrer headers originating from external domains preceding voucher endpoint access spikes

Detection Strategies

Deploy web application firewall rules that inspect query parameter names, not just values, for HTML metacharacters
Correlate short-lived, high-volume access to /account/voucher from unique client IPs with a common referrer
Review OpenCart version banners exposed by storefront responses to identify installations below 4.1.0

Monitoring Recommendations

Aggregate storefront HTTP logs into a centralized analytics platform and alert on anomalous parameter structures
Track outbound clicks from voucher pages to external domains that could indicate successful phishing overlays
Monitor customer support channels for user reports of unexpected login prompts or altered voucher pages

How to Mitigate CVE-2025-1749

Immediate Actions Required

Upgrade OpenCart to version 4.1.0 or later on all production and staging storefronts
Inventory OpenCart deployments and confirm the running version through the admin panel or file admin/config.php
Educate customer-facing staff and end users about phishing links referencing voucher URLs

Patch Information

OpenCart addressed the HTML injection in the 4.1.0 release by adding proper output encoding to the voucher endpoint parameter handling. Administrators should follow the official OpenCart upgrade procedure, back up the database and storage/ directory, and validate custom themes for compatibility. Consult the INCIBE Early Warning Advisory for confirmation of the fixed version.

Workarounds

Apply a WAF rule that blocks requests to /account/voucher containing HTML metacharacters in parameter names
Restrict access to the voucher module through reverse proxy rules until the upgrade is completed
Enable a strict Content Security Policy (CSP) that limits inline HTML rendering and external resource loading on storefront pages

bash

# Example nginx rule blocking HTML metacharacters in voucher requests
location /account/voucher {
    if ($args ~* "(<|%3C|>|%3E)") {
        return 403;
    }
    proxy_pass http://opencart_backend;
}