# Exploit Title: Opencart 3.x.x Authenticated Stored XSS
# Date: 08/15/2019
# Exploit Author: Nipun Somani
# Author Web: http://thehackerstore.net
# Vendor Homepage: https://www.opencart.com/
# Software Link: https://github.com/opencart/opencart
# Version: 3.x.x
# Tested on: Debian 9, Windows 10 x64
# CVE : CVE-2019-15081
The Opencart Version 3.x.x allows editing Source/HTML of the Categories /
Product / Information pages in the admin panel which isn't sanitized to
leading to Stored Cross-Site-Scripting(XSS).
1. Log-in to admin-panel.
2. Navigate to Catlog and then select any of [Categories or Products or Information] options and and pick any entry or create one.
3. Under description click on Source option and insert your XSS payload.
4. Now visit the modified page of your public website. And your injected XSS payload will execute.