Opencart TMD Vendor System 3.x Blind SQL Injection via product route
Vulnerability Description
Opencart TMD Vendor System 3.x contains a blind SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through the product_id parameter. Attackers can craft malicious SQL queries using time-based or content-based blind injection techniques to enumerate usernames, emails, and password reset codes from the oc_user table.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-47928
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Muhammad Zaki Sulistya (zaki.sulistya@gmail.com)
Affected Vendor
opencartextensions
View all reports →