openCart Server-Side Template Injection (SSTI) vulnerability

published 2024-07-17 2 y ago modified 2026-09-10 1 mo ago also BIT-opencart-2024-36694 , EUVD-2024-2454 , GHSA-xrh7-2gfq-4rcq

cvss: 7.2; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.9%; EPSS 0.9% chance of exploitation in 30 days, percentile 60%
public exploits: 0; none known

OpenCart 4.0.2.3 is vulnerable to Server-Side Template Injection (SSTI) via the Theme Editor Function.

Patch / fix

fixed in 1 links 1

bitnami opencart 4.1.0

github.com/opencart/opencart/releases/tag/4.0.2.3 release

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: total
Assessed: 22 mo ago (2024-12-31)

Exploit prediction

0.92% chance of exploitation in the next 30 days, higher than 60% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

medium.com https://medium.com/@pawarit.sanguanpang/opencart-v4-0-2-3-server-side-template-injection-0b173a3bdcf9 referenced PoC, tagged "exploit" by a source, unverified
github.com https://github.com/A3h1nt/CVEs/blob/main/OpenCart/Readme.md referenced PoC, tagged "exploit" by a source, unverified
github.com https://github.com/PawaritSanguanpang/CVEs/blob/main/OpenCart/CVE-2024-36694/README.md referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
GitHub	3.1	8.0	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CNA	3.1	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
OSV	3.1	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
packagist	opencart/opencart	<=4.0.2.3	no fix listed
bitnami	opencart	<4.1.0	4.1.0

Classification

Weakness

CWE-94 Improper Control of Generation of Code
CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine

References

medium.com /@pawarit.sanguanpang/opencart-v4-0-2-3-server-side-template-injection-0b173a3bdcf9
exploit, web, third-party-advisory
github.com /A3h1nt/CVEs/blob/main/OpenCart/Readme.md
web, exploit, third-party-advisory
github.com /PawaritSanguanpang/CVEs/blob/main/OpenCart/CVE-2024-36694/README.md
exploit, third-party-advisory, web
github.com /opencart/opencart/issues/13863
web, issue-tracking, vendor-advisory
github.com /opencart/opencart/releases/tag/4.0.2.3
web, product
nvd.nist.gov /vuln/detail/CVE-2024-36694
advisory, web
github.com /opencart/opencart
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary