CVE-2025-0580: Shiprocket Module REST API Module rest_api authorization
A vulnerability was found in Shiprocket Module 3 on OpenCart. It has been rated as critical. Affected by this issue is some unknown functionality of the file /index.php?route=extension/module/restapi&action=getOrders of the component REST API Module. The manipulation of the argument contentHash leads to incorrect authorization. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0580?
CVE-2025-0580 has been rated as critical.
What components are affected by CVE-2025-0580?
CVE-2025-0580 affects the Shiprocket Module 3 and the OpenCart REST API Module.
How do I fix CVE-2025-0580?
To fix CVE-2025-0580, update to the latest version of the Shiprocket Module or apply a patch if available.
What is the vulnerability in CVE-2025-0580?
CVE-2025-0580 involves a manipulation vulnerability in the REST API Module at the endpoint '/index.php?route=extension/module/rest_api&action=getOrders'.
What should I do if my system is affected by CVE-2025-0580?
If your system is affected by CVE-2025-0580, it is recommended to immediately update the affected modules and review system logs for suspicious activity.