Waraxe

The anti-traversal code implemented in the filemanager.php of OpenCart is ineffective and can be bypassed.

A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the `Mod` cookie parameter to the "html/modules.php" endpoint.

A SQL injection issue allows remote attackers to execute arbitrary SQL commands via the `user ID` in a user cookie.

The issue allows remote attackers to execute arbitrary SQL commands via various parameters in different PHP files, including the `orderby` parameter to "downloads.php", and several parameters in "forum/postedit.php", "forum/postnewthread.php", "administration/settings messages.php", "administration/settings photo.php", "administration/bbcodes.php", "administration/news.php", and "administration/articles.php". The vulnerable parameters include `delete attach ` in "forum/postedit.php", `poll opts[]` in "forum/postnewthread.php", `pm email notify`, `pm save sent`, `pm inbox`, `pm sentbox`, and `pm savebox` in "administration/settings messages.php", `thumb compression`, `photo watermark text color1`, `photo watermark text color2`, and `photo watermark text color3` in "administration/settings photo.php", `enable` in "administration/bbcodes.php", `news image`, `news image t1`, and `news image t2` in "administration/news.php", `news id` in "administration/news.php", and `article id` in "administration/articles.php".

The issue allows remote attackers to obtain sensitive information by requesting a backup file directly. This is possible because backup files are stored with predictable filenames in an unrestricted directory under the web document root, specifically in administration/db backups/.

The issue allows remote authenticated users to include and execute arbitrary files via a .. (dot dot) in the `user theme` parameter to "maincore.php". Additionally, remote authenticated administrators can delete arbitrary files via the `enable` parameter to "administration/user fields.php" or the `file` parameter to "administration/db backup.php".

The issue allows remote attackers to inject arbitrary web script or HTML via several parameters, including the `highlight` parameter to "forum/viewthread.php", `user list` or `user types` parameters to "messages.php", `message` parameter to "infusions/shoutbox panel/shoutbox admin.php" or "administration/news.php", `panel list` parameter to "administration/panel editor.php", the HTTP User Agent string to "administration/phpinfo.php", the `" BBCODE "` parameter to "administration/bbcodes.php", `errorMessage` parameter to various scripts in the administration directory when the error is 3, or the `body` or `body2` parameters to "administration/articles.php".

The issue allows remote authenticated users to execute arbitrary code via a `/ex00` sequence. This sequence is not properly handled before making a `preg replace` function call within the "Replace table prefix" feature.

The issue allows remote attackers to bypass authentication and gain administrator access. This is achieved by setting the `userkey` cookie to 1, effectively allowing unauthorized access to administrative functions.

The issue concerns SQL injection vulnerabilities in the ajaxserver.php file. These vulnerabilities allow remote attackers to execute arbitrary SQL commands. The vulnerabilities are specifically found in the `curstr` parameter of the `findUsers` function, the `id` parameter of the `isIdAvailable` function, and the `username` parameter of the `getGreetings` function.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML. This is achieved by manipulating the `do` parameter to `index.php`.

The issue allows remote attackers to obtain sensitive information via various invalid parameters to different scripts, which reveals the installation path in an error message. This can be achieved by making a direct request to "plugins/visiblehookpoints/index.php", or by providing an invalid `page` or `cat` parameter to "thumbnails.php", an invalid `page` parameter to "usermgr.php", or an invalid `newer than` or `older than` parameter to "search.inc.php".

A cross-site scripting (XSS) issue exists, allowing remote authenticated users with certain privileges to inject arbitrary web script or HTML via the `keywords` parameter in the edit one pic.php file.

The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the `h` and `t` parameters to "help.php", or the `picfile XXX` parameter to "searchnew.php".

The issue allows remote attackers to conduct directory traversal attacks and read arbitrary files. This is achieved by manipulating the `file` parameter with "logs/" in between two . (dot) characters, which is filtered into a "../" sequence, enabling access to files outside the intended directory.

The issue allows remote attackers to obtain sensitive information via a direct request to "include/slideshow.inc.php", which leaks the installation path in an error message.

The issue allows remote attackers to obtain sensitive information, such as the database table prefix, by making a direct request to the "update.php" endpoint. This could potentially be used to aid in attacks.

The issue allows remote attackers to obtain a password via a brute-force attack because the `account-recover.php` file chooses random passwords from an insufficiently large set.

The issue concerns the backup-database.php file, which does not require administrative authentication. This allows remote attackers to create and download a backup database by making a direct request and then retrieving a .gz file from the backups/ directory.

A directory traversal issue exists in the backend/admin-functions.php file, allowing remote attackers to include and execute arbitrary local files. This is achieved by using a .. (dot dot) in the `ss uri` parameter, in conjunction with a modified component name, on case-insensitive web sites.