OpenCart SQL Injection Vulnerability Affects Versions 0.0.0-3.0.3.9
CVE-2024-21514
Key Information:
- Vendor
- opencart
- Status
- Vendor
- CVE Published:
- 22 June 2024
Badges
Summary
The vulnerability constitutes an SQL Injection flaw present in the Divido payment extension for OpenCart, included by default in OpenCart version 3.0.3.9. An unauthenticated user could potentially exploit this vulnerability, enabling unauthorized access to the backend database. The exploitation allows for the dumping of the entire OpenCart database, which can include sensitive customer Personally Identifiable Information (PII). For any installations of OpenCart utilizing the Divido payment module, security risks are posed regardless of the module's activation status. Immediate attention and remediation are recommended for affected users to safeguard their data and maintain system integrity.
Affected Version(s)
opencart/opencart 0.0.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
EPSS Score
37% chance of being exploited in the next 30 days.
CVSS V3.1
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved