Janek Vind

The anti-traversal code implemented in the filemanager.php of OpenCart is ineffective and can be bypassed.

A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the `Mod` cookie parameter to the "html/modules.php" endpoint.

A SQL injection issue allows remote attackers to execute arbitrary SQL commands via the `user ID` in a user cookie.

The issue allows remote attackers to execute arbitrary SQL commands via various parameters in different PHP files, including the `orderby` parameter to "downloads.php", and several parameters in "forum/postedit.php", "forum/postnewthread.php", "administration/settings messages.php", "administration/settings photo.php", "administration/bbcodes.php", "administration/news.php", and "administration/articles.php". The vulnerable parameters include `delete attach ` in "forum/postedit.php", `poll opts[]` in "forum/postnewthread.php", `pm email notify`, `pm save sent`, `pm inbox`, `pm sentbox`, and `pm savebox` in "administration/settings messages.php", `thumb compression`, `photo watermark text color1`, `photo watermark text color2`, and `photo watermark text color3` in "administration/settings photo.php", `enable` in "administration/bbcodes.php", `news image`, `news image t1`, and `news image t2` in "administration/news.php", `news id` in "administration/news.php", and `article id` in "administration/articles.php".

The issue allows remote authenticated users to include and execute arbitrary files via a .. (dot dot) in the `user theme` parameter to "maincore.php". Additionally, remote authenticated administrators can delete arbitrary files via the `enable` parameter to "administration/user fields.php" or the `file` parameter to "administration/db backup.php".

The issue allows remote attackers to obtain sensitive information by requesting a backup file directly. This is possible because backup files are stored with predictable filenames in an unrestricted directory under the web document root, specifically in administration/db backups/.

The issue allows remote attackers to inject arbitrary web script or HTML via several parameters, including the `highlight` parameter to "forum/viewthread.php", `user list` or `user types` parameters to "messages.php", `message` parameter to "infusions/shoutbox panel/shoutbox admin.php" or "administration/news.php", `panel list` parameter to "administration/panel editor.php", the HTTP User Agent string to "administration/phpinfo.php", the `" BBCODE "` parameter to "administration/bbcodes.php", `errorMessage` parameter to various scripts in the administration directory when the error is 3, or the `body` or `body2` parameters to "administration/articles.php".

The issue allows remote authenticated users to execute arbitrary code by using a double extension in the filename of an export file. This can lead to the interpretation of the file as an executable file by the Apache HTTP Server, as demonstrated by a .php.sql filename.

The issue allows remote authenticated users to inject values via a crafted request, potentially leading to unauthorized access or data manipulation. This is due to the export.php script overwriting global variables based on the contents of the POST superglobal array.

The issue concerns a directory traversal vulnerability in the Export feature. This allows remote authenticated users to read arbitrary files or possibly have unspecified other impact via a parameter that specifies a crafted export type.

Multiple cross-site scripting (XSS) vulnerabilities in tbl gis visualization.php might allow remote attackers to inject arbitrary web script or HTML via the (1) `visualizationSettings[width]` or (2) `visualizationSettings[height]` parameter.

The issue concerns SQL injection vulnerabilities in the ajaxserver.php file. These vulnerabilities allow remote attackers to execute arbitrary SQL commands. The vulnerabilities are specifically found in the `curstr` parameter of the `findUsers` function, the `id` parameter of the `isIdAvailable` function, and the `username` parameter of the `getGreetings` function.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML. This is achieved by manipulating the `do` parameter to `index.php`.

The issue allows remote attackers to bypass authentication and gain administrator access. This is achieved by setting the `userkey` cookie to 1, effectively allowing unauthorized access to administrative functions.

The issue allows remote attackers to obtain sensitive information via various invalid parameters to different scripts, which reveals the installation path in an error message. This can be achieved by making a direct request to "plugins/visiblehookpoints/index.php", or by providing an invalid `page` or `cat` parameter to "thumbnails.php", an invalid `page` parameter to "usermgr.php", or an invalid `newer than` or `older than` parameter to "search.inc.php".

A cross-site scripting (XSS) issue exists, allowing remote authenticated users with certain privileges to inject arbitrary web script or HTML via the `keywords` parameter in the edit one pic.php file.

The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the `h` and `t` parameters to "help.php", or the `picfile XXX` parameter to "searchnew.php".

A stack-based buffer overflow issue exists in the login form of the management web server, allowing remote attackers to execute arbitrary code via the `Login` variable.

The issue allows remote attackers to conduct directory traversal attacks and read arbitrary files. This is achieved by manipulating the `file` parameter with "logs/" in between two . (dot) characters, which is filtered into a "../" sequence, enabling access to files outside the intended directory.

The issue allows remote attackers to obtain sensitive information via a direct request to "include/slideshow.inc.php", which leaks the installation path in an error message.