Hah, in one of the replies someone mentions a session hijacking issue https://github.com/opencart/opencart/issues/12939 https://github.com/opencart/opencart/iss

Hah, in one of the replies someone mentions a session hijacking issue https://github.com/opencart/opencart/issues/12939 https://github.com/opencart/opencart/issues/12939 but the guy's response was: > what a great hacker! this man should be put on a pedestal for as the worlds greatest hacker for using inspect element and copy and pasting his user_token var from the browser. now if he can only get it to work on a 3rd party who's cookie and user_token he wont know! lets not forget SSL. > fucking dickhead banned! Wow mate, that issue mentions social engineering (Facebook has a big fat warning about SelfXSS if you open the browser's developer console), and you choose to ignore this part? Also, relying on other tech like SSL to hopefully keep the hole in your code from losing your users' money? Haaah. It's GPL, anyone wanna fork it and call it DickheadCart?