CVE-2024-21514: SQL Injection in OpenCart
Summary
CVE-2024-21514: SQL injection in opencart. Affects opencart/opencart versions < 3.0.3.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenCart is an open-source e-commerce platform that allows users to create and manage online stores. It is widely used for its flexibility, user-friendly interface, and extensive range of features. The vulnerability affects versions of the package opencart/opencart from 0.0.0. The Divido payment extension, included by default in OpenCart version 3.0.3.9, is susceptible to an SQL Injection issue. This vulnerability allows anonymous unauthenticated users to exploit the Divido payment module and gain unauthorized access to the backend database. Even if the module is not enabled, an attacker can still exploit the SQL injection to dump the entire OpenCart database, including sensitive customer Personally Identifiable Information (PII) data.
Vulnerability Detail
The SQL Injection vulnerability in the Divido payment extension for OpenCart allows unauthenticated users to execute arbitrary SQL queries and gain unauthorized access to the backend database. By exploiting this vulnerability, an attacker can extract sensitive information from the database, including customer PII data. This can lead to identity theft, fraud, and other malicious activities. The vulnerability has a CVSS score of 7.4, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, it is advised to disable or remove the Divido payment extension from the OpenCart installation. This can be done by accessing the OpenCart admin panel, navigating to the Extensions section, and disabling or uninstalling the Divido payment module. However, this workaround may impact the functionality of the payment system, so it is crucial to apply the recommended fix as soon as possible.
Conclusion
The SQL Injection vulnerability in the Divido payment extension for OpenCart poses a significant risk to the security and integrity of OpenCart installations. It allows unauthenticated users to gain unauthorized access to the backend database and extract sensitive information. To mitigate this risk, it is essential to promptly update the opencart/opencart package and the Divido payment extension to the latest versions. Regularly monitoring for security updates and applying them is crucial for maintaining the security of OpenCart installations.
See every vulnerability recorded for opencart/opencart →
FAQ
OpenCart is an open-source e-commerce platform used for creating and managing online stores.
The Divido payment extension is a module included in OpenCart that enables the integration of the Divido payment system for installment purchases.
Any OpenCart installation using the Divido payment extension, specifically versions up to 3.0.3.9, is vulnerable to this SQL Injection issue.
By exploiting this vulnerability, an attacker can gain unauthorized access to the backend database and extract sensitive information, including customer PII data.
To protect your OpenCart installation, it is crucial to update both the opencart/opencart package and the Divido payment extension to the latest versions, which include the necessary security patches.
Related vulnerabilities
Recent vulnerabilities recorded for opencart/opencart.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
