CVE-2024-21519

An attacker with admin privileges can inject PHP code into the database, then use the database restoration functionality to create a backup file with an arbitrary filename (including extension) inside `/system/storage/backup` [ref_id=1][ref_id=3]. The Snyk advisory shows that the `filename` parameter of the `admin/tool/upload.upload` route bypasses the application's default `htmlspecialchars` encoding, allowing unencoded data to be stored in the database [ref_id=3]. Because the filename is attacker-controlled and not validated, the resulting file can contain PHP code and be named with a `.php` extension [CWE-20]. The advisory notes that the storage path is typically outside the web root per security recommendations, making direct remote execution less likely [ref_id=1][ref_id=3].

The vulnerability exists in the database restoration functionality of OpenCart. The Snyk advisory identifies the `admin/tool/upload.upload` route as a specific entry point, noting that the `filename` parameter in that route is not sanitized like other user input (which is passed through `htmlspecialchars` at startup) [ref_id=3]. The backup file is created within `/system/storage/backup` [ref_id=1][ref_id=3].

The Snyk advisory states that there is no fixed version for opencart/opencart as of the disclosure date [ref_id=3]. The remediation guidance is implicit in the vulnerability description: input validation must be added to the `filename` parameter (and similar parameters) in the database restoration and upload functionality to prevent arbitrary file creation [CWE-20]. Without a published patch, administrators should ensure the storage directory is moved outside the web root as recommended, and restrict admin panel access to trusted users only [ref_id=1][ref_id=3].

The Snyk advisory provides a partial PoC showing the HTTP request to the vulnerable route: `POST http://127.0.0.1/opencart/admin/index.php?route=tool/upload.upload&user_token=cd4d0433339a18c414c67e090c96a9f2` with `Content-Type: multipart/form-data` [ref_id=3]. The advisory notes that the `filename` parameter in this route is not passed through `htmlspecialchars` like other user input, allowing unencoded data to be stored in the database [ref_id=3]. Full reproduction steps are not provided beyond this request template.