A vulnerability was found in TMD Custom Header Menu 4

CVE-2025-0214 is a SQL injection in the third-party TMD Custom Header Menu extension for OpenCart. The public advisory says the vulnerable OpenCart 4 release is 4.0.0.1, with an older OpenCart 3 branch also affected, and the bug sits in admin-side handling of the headermenu_id parameter on routes reached through /admin/index.php; the parameter is fed into a database query without proper neutralization.

The vendor's MEDIUM 4.1 is still too generous for patch triage at enterprise scale. The decisive friction is that exploitation needs authenticated access to the OpenCart admin UI or a stolen valid admin session plus user_token, which makes this a *post-initial-access* bug in a relatively niche extension, not an internet-sweepable foothold; the public PoC and real data-exposure potential keep it above IGNORE, but not by much.

Why this verdict

• Major downgrade for attacker position: exploitation needs admin-panel access, a stolen admin cookie, or admin-browser script execution. That is already a serious prior compromise stage.
• Population is narrow: this is a third-party OpenCart extension, not OpenCart core, so the exposed estate is a small subset of ecommerce installs rather than a broad enterprise platform surface.
• Threat pressure is weak: no KEV entry, no confirmed active exploitation, and the supplied EPSS is extremely low despite public PoC availability.

Why not higher?

If this were unauthenticated or even low-privilege authenticated, it would climb fast because SQLi against a live store database is nasty. But requiring high privileges plus a valid session token means most attackers who can use this have already crossed the hard boundary.

Why not lower?

This is still genuine SQL injection with a public PoC, not a theoretical bug. On a live store, successful abuse can expose customer data, admin credentials, and order records, so defenders should not dismiss it outright if the extension is present.

1. Restrict admin reachability — Put /admin behind IP allowlists, VPN, or an identity-aware proxy so fewer attackers can ever satisfy the precondition. For a LOW verdict there is no SLA; treat as backlog hygiene, but this is the best risk-reduction move if you cannot patch immediately.
2. Audit admin roles — Review OpenCart user groups and remove extension access from anyone who does not need it; the exploit path dies if the compromised user cannot reach the module route. For a LOW verdict there is no SLA; treat as backlog hygiene, but make it part of the next permissions review.
3. Hunt for session misuse — Search reverse-proxy and application logs for suspicious /admin/index.php requests containing headermenu_id= with SQL metacharacters, especially from unusual IPs or admin accounts. For a LOW verdict there is no SLA; treat as backlog hygiene, but do it promptly if the store handles regulated customer data.
4. Disable or remove the extension if unused — If the business does not actively use TMD Custom Header Menu, removing the plugin is cleaner than carrying a low-value third-party risk surface. For a LOW verdict there is no SLA; treat as backlog hygiene, and this should be part of normal extension rationalization.

Run this on the target OpenCart host against the web root, for example: sudo bash verify-cve-2025-0214.sh /var/www/html. Read access to the OpenCart files is required; root is helpful but not mandatory if the web tree is readable.

#!/usr/bin/env bash
# verify-cve-2025-0214.sh
# Check OpenCart filesystem for the TMD Custom Header Menu extension and look for
# unsanitized use of the headermenu_id parameter in admin-side PHP code.
#
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

set -u

WEBROOT="${1:-}"
if [[ -z "$WEBROOT" || ! -d "$WEBROOT" ]]; then
  echo "UNKNOWN: usage: $0 /path/to/opencart/webroot"
  exit 2
fi

# Candidate files/dirs commonly seen for this extension across OC3/OC4 layouts
mapfile -t CANDIDATES < <(find "$WEBROOT" \
  \( -iname '*tmdcustomheader*' -o -iname '*headermenu*' \) \
  2>/dev/null)

if [[ ${#CANDIDATES[@]} -eq 0 ]]; then
  echo "UNKNOWN: no TMD Custom Header Menu extension artifacts found under $WEBROOT"
  exit 2
fi

VULN_FOUND=0
PATCHED_FOUND=0
VERSION_HIT=0

for f in "${CANDIDATES[@]}"; do
  if [[ -f "$f" ]]; then
    # Version hint
    if grep -Eq '4\.0\.0\.1' "$f" 2>/dev/null; then
      VERSION_HIT=1
    fi

    # Look for direct request usage around headermenu_id
    if grep -Eq "headermenu_id" "$f" 2>/dev/null; then
      # Patched indicators: explicit cast or escaping applied to headermenu_id
      if grep -Eq "\(int\)[^\n]*headermenu_id|intval\([^\n]*headermenu_id|escape\([^\n]*headermenu_id" "$f" 2>/dev/null; then
        PATCHED_FOUND=1
      fi

      # Vulnerable indicators: raw request parameter pulled and later used in query-building code
      if grep -Eq "request->get\['headermenu_id'\]|\$_GET\['headermenu_id'\]" "$f" 2>/dev/null; then
        if grep -Eq "db->query\(|SELECT |UPDATE |DELETE |INSERT " "$f" 2>/dev/null; then
          if ! grep -Eq "\(int\)[^\n]*headermenu_id|intval\([^\n]*headermenu_id|escape\([^\n]*headermenu_id" "$f" 2>/dev/null; then
            VULN_FOUND=1
          fi
        fi
      fi
    fi
  fi
done

if [[ $VULN_FOUND -eq 1 ]]; then
  if [[ $VERSION_HIT -eq 1 ]]; then
    echo "VULNERABLE: extension artifacts include version 4.0.0.1 and unsanitized headermenu_id handling"
  else
    echo "VULNERABLE: unsanitized headermenu_id handling found in TMD Custom Header Menu code"
  fi
  exit 1
fi

if [[ $PATCHED_FOUND -eq 1 ]]; then
  echo "PATCHED: extension present and headermenu_id appears to be cast/escaped before query use"
  exit 0
fi

echo "UNKNOWN: extension artifacts found, but vulnerable/patched state could not be determined conclusively"
exit 2

Sources

1. NVD record for CVE-2025-0214
2. Public advisory and PoC by mcdruid
3. VulDB entry VDB-290159
4. OpenCart user groups and admin permissions
5. OpenCart extension developer guide
6. TMD Custom Header Menu product page
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST EPSS model overview