CVE-2024-21514CWE-89

This affects versions of the package opencart/opencart from 0.0.0

High · published June 22, 2024

CVSS v3.1
7.4
EPSS
19%
Percentile
97.3
In the wild
Unconfirmed
What it is

This affects versions of the package opencart/opencart from 0.0.0. An SQL Injection issue was identified in the Divido payment extension for OpenCart, which is included by default in version 3.0.3.9. As an anonymous unauthenticated user, if the Divido payment module is installed (it does not have to be enabled), it is possible to exploit SQL injection to gain unauthorised access to the backend database. For any site which is vulnerable, any unauthenticated user could exploit this to dump the entire OpenCart database, including customer PII data.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H/E:P
CVSS v4.0
Not supplied
EPSS
0.19080 · 97.3th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2024-06-22T05:00Z
EPSS history
Timeline
  • 22 JUN 05:00Z
    This affects versions of the package opencart/opencart from 0.0.0
    cvelistv5