thank you!

to pull this hack off you would need to send a email or trick the owner of the site to visit a link while they is logged into their opencart admin.

it not easy to do this!

but still this sort of thing can be prevented by renaming the admin like prestashop does. 