CVE-2018-1000640

Vulnerability

OpenCart-Overclocked version <=1.11.1 contains a reflected Cross-Site Scripting (XSS) vulnerability in the admin OpenBay template. The JavaScript function on line 95 of upload/admin/view/template/extension/openbay.tpl directly echoes the token GET parameter without sanitization: var token = "<?php echo $_GET['token']; ?>" [1][4]. This allows an attacker to inject arbitrary JavaScript code through a crafted token value.

Exploitation

The attacker can exploit this by crafting a malicious URL containing a token parameter with JavaScript code, then coercing a victim (such as an administrator) to visit that link [4]. No authentication is required for the initial request, though the template is in the admin panel. User interaction (clicking the link) is necessary for successful exploitation [1][4].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser within the admin session context. This can lead to unauthorised actions (such as modifying store settings), access to sensitive data (including session cookies), stealing session information, or denial of service [1][4].

Mitigation

No official patch or fixed version has been publicly released by the project maintainer; the repository was archived in December 2023 and is read-only [2]. As a workaround, administrators should sanitize the token parameter in the OpenBay template, enforce HTTPS, and consider implementing a Content Security Policy (CSP). The project appears to be end-of-life [2].