OpenCart Stored Cross-Site Scripting Vulnerability in Blog Editor

A stored cross-site scripting vulnerability has been identified in OpenCart version 4.1.0.4 and earlier. This issue arises in the blog editor, where user input is not adequately sanitized before being displayed. As a result, attackers can inject malicious JavaScript that executes when the blog post is viewed.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the blog post.

Reproduction

To reproduce this vulnerability, navigate to the blog editor in the admin panel of OpenCart 4.1.0.4 or earlier. Insert a script payload, such as a JavaScript alert, into the editor. After saving the blog post, the injected script will execute when the post is viewed.