SQL Injection Vulnerability in jCart for OpenCart by Joomla!
CVE-2017-20282

8.8HIGH

Key Information:

Vendor

Soft-PHP

Status
Jcart For Opencart
Vendor
CVE Published:
19 June 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2017-20282?

The jCart component for OpenCart version 2.0, developed by Joomla!, is susceptible to an SQL injection vulnerability that permits unauthenticated attackers to manipulate database queries. By sending specially crafted GET requests to the index.php endpoint with the option=com_jcart&route=product/product parameters, attackers can inject malicious SQL code via the product_id parameter. This exploitation can lead to unauthorized access to sensitive database information, making it crucial for users to apply necessary security patches and updates.

Affected Version(s)

jCart for OpenCart 2.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2017-20282 - Proof of Concept

References

https://www.exploit-db.com/exploits/41642
exploit
http://soft-php.com
product
https://www.vulncheck.com/advisories/joomla-component-jca...
third-party-advisory

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ihsan Sencan
.