CVE-2021-47946

Vulnerability

OpenCart 3.0.3.6 is vulnerable to a cross-site request forgery (CSRF) attack targeting the /account/edit endpoint [1][2]. The vulnerability stems from a lack of anti-CSRF tokens or other validation mechanisms on the account modification form, allowing an unauthenticated attacker to forge requests that change a victim's account details, including their email address and name [1].

###Exploitation requires tricking a logged-in victim into visiting a malicious HTML page crafted by the attacker. The attacker must first generate a valid CSRF payload by intercepting a legitimate request to /account/edit (e.g., from their own account) and editing the email to an attacker-controlled address not yet registered [1]. When the victim opens the malicious page, the forged request is sent with the victim's session, silently updating their account email [1][2]. The attack does not require authentication from the attacker's side at the time of exploitation, only that the victim is authenticated [2].

###The impact is full account takeover. After the victim's email is changed to an attacker-controlled address, the attacker can use the "forgot password" function to receive a password reset link via email, gaining access to the victim's account [1]. This compromises all account data and any associated functionality, such as order history or stored payment details [2]. 1][2].

###The vulnerability affects OpenCart versions 3.0.3.6 and below [1][2]. As of the publication date, the vendor has not released a patch for this issue; users are advised to implement CSRF protection manually or monitor for updates [2]. No evidence exists of active exploitation in the wild or inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog.