CVE-2025-45893

Executive Summary

CVE-2025-45893 is a Stored Cross-Site Scripting (XSS) vulnerability affecting OpenCart version 4.1.0.4. The flaw resides in the media manager component, which fails to properly sanitize SVG file uploads used in blog posts. An authenticated attacker with low privileges can upload a malicious SVG file containing embedded JavaScript. When other users (including administrators) view the blog post containing the uploaded SVG, the malicious script executes in their browser context, leading to session hijacking, credential theft, or defacement. The vulnerability is currently unpatched, and a proof-of-concept exists publicly.

CVSS Breakdown & Threat Level

• CVSS Score: 4.6 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: Required (victim must view the blog post)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires authentication but is straightforward. The stored nature of the XSS increases the potential for widespread impact within an organization.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS via SVG upload. OpenCart 4.1.0.4's media manager allows users to upload SVG files for use in blog posts. The application does not validate or sanitize the content of SVG files. An attacker can craft an SVG file that contains embedded JavaScript, for example:

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <script type="text/javascript">
    alert('XSS');
  </script>
</svg>

When the SVG is rendered in a browser, the <script> tag executes. The attack flow is:

1. Attacker logs in with low-privileged credentials.
2. Attacker uploads the malicious SVG via the media manager.
3. Attacker creates or edits a blog post and inserts the SVG.
4. Victim (admin or other user) views the blog post.
5. The SVG is rendered, and the JavaScript executes in the victim's session.

The lack of Content-Type validation and absence of SVG-specific sanitization (e.g., stripping <script> tags, onload attributes, or xmlns manipulation) are the root causes.

Vulnerable vs. Patched Code

Vulnerable Code (OpenCart 4.1.0.4):

The media manager upload handler likely only checks the file extension (.svg) but does not inspect the file content. Example pseudocode:

// Vulnerable upload handler
if (in_array($extension, ['svg', 'png', 'jpg'])) {
    move_uploaded_file($file, $target_path);
    // No content validation
}

Patched Code (Hypothetical):

A patched version would sanitize SVG files by removing executable elements:

// Patched upload handler
if ($extension === 'svg') {
    $svg = file_get_contents($file);
    // Remove script tags and event handlers
    $svg = preg_replace('/<script[^>]*>.*?<\/script>/si', '', $svg);
    $svg = preg_replace('/\bon\w+\s*=\s*"[^"]*"/i', '', $svg);
    file_put_contents($target_path, $svg);
}

Additionally, serving SVG files with Content-Type: image/svg+xml and a Content-Security-Policy header that blocks inline scripts would mitigate execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• OpenCart 4.1.0.4 instance
• Low-privileged user account (e.g., editor role)
• Access to the media manager and blog post editor

Steps:

1. Craft Malicious SVG: Create a file named exploit.svg with the following content:

   <?xml version="1.0" encoding="UTF-8"?>
   <svg xmlns="http://www.w3.org/2000/svg" width="200" height="200">
     <script type="text/javascript">
       fetch('/admin/index.php?route=common/login', {
         method: 'POST',
         headers: {'Content-Type': 'application/x-www-form-urlencoded'},
         body: 'username=admin&password=stolen'
       });
     </script>
   </svg>
   

2. Upload SVG:

   • Log in as the low-privileged user.
   • Navigate to System > Design > Banners or Marketing > Blog.
   • Use the media manager to upload exploit.svg.

3. Embed in Blog Post:

   • Create a new blog post.
   • Insert the uploaded SVG using the media manager's image picker.
   • Publish the post.

4. Trigger:

   • Send the blog post URL to an administrator.
   • When the admin views the post, the SVG executes, sending their credentials to an attacker-controlled server.

Blue Team

Detection:

• Monitor for SVG file uploads with unusual sizes or containing <script> tags.
• Review web server logs for requests to /admin/index.php?route=common/login with POST data containing username=admin.
• Use WAF rules to block SVG files containing <script> or onload attributes.

Hunting:

• Search the filesystem for SVG files containing <script> tags.
• Check database entries for blog posts containing SVG references.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example malicious SVG)
• Network Indicators:
  • POST requests to /admin/index.php?route=common/login with unusual Referer headers.
  • Outbound connections to unknown IPs on port 80/443 from the OpenCart server.
• Log Entries:
  • [error] [client 192.168.1.100] File upload: exploit.svg (size: 1234 bytes)
  • [info] [client 192.168.1.100] POST /admin/index.php?route=common/login

Detection Engineering

YARA Rule

rule detect_malicious_svg_xss {
    meta:
        description = "Detects SVG files containing embedded JavaScript for XSS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-45893"
    strings:
        $svg_header = "<?xml" ascii wide nocase
        $svg_tag = "<svg" ascii wide nocase
        $script_tag = "<script" ascii wide nocase
        $event_handler = /on\w+\s*=/ ascii wide nocase
    condition:
        $svg_header and $svg_tag and ($script_tag or $event_handler)
}

Sigma Rule

title: OpenCart SVG Upload XSS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to upload SVG files with embedded JavaScript to OpenCart
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/admin/index.php*'
        cs-uri-query: '*route=common/filemanager*'
        cs-User-Agent: '*'
        cs-Referer: '*'
    condition: selection
falsepositives:
    - Legitimate SVG uploads by developers
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-45893 OpenCart SVG XSS Upload"; flow:to_server,established; content:"POST"; http_method; content:"/admin/index.php"; http_uri; content:"route=common/filemanager"; http_uri; content:"svg"; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/si"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable SVG uploads in the media manager configuration until a patch is released.
2. Implement a WAF rule to block SVG files containing <script> tags or event handlers.
3. Restrict media manager access to only trusted administrators.

Long-term Fix:

• Apply the official patch from OpenCart when available.
• Implement server-side SVG sanitization using libraries like svg-sanitizer (PHP).
• Serve SVG files with Content-Type: image/svg+xml and a strict Content-Security-Policy header.

Workaround:

• Modify the upload handler to reject SVG files entirely or convert them to PNG on upload.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert