TI-2024-14270 Aliases CVE-2024-21514 GHSA-7crj-24g3-g7h7

SQL injection in opencart/opencart

HIGH 68CWE-89Published 2024-06-22 · Updated 2024-08-01

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: SQL injection
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

This affects versions of the package opencart/opencart from 0.0.0. An SQL Injection issue was identified in the Divido payment extension for OpenCart, which is included by default in version 3.0.3.9. As an anonymous unauthenticated user, if the Divido payment module is installed (it does not have to be enabled), it is possible to exploit SQL injection to gain unauthorised access to the backend database. For any site which is vulnerable, any unauthenticated user could exploit this to dump the entire OpenCart database, including customer PII data.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.1908 97th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	opencart/opencart	0.0.0 and later	—	No fix listed	CNA
—	opencart/opencart (Packagist)	up to 3.0.3.9	—	No fix listed	GHSA-7crj-24g3-g7h7

opencart/opencart Vendor— Affected 0.0.0 and later Fixed in — No fix listed CNA
opencart/opencart (Packagist) Vendor— Affected up to 3.0.3.9 Fixed in — No fix listed GHSA-7crj-24g3-g7h7

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:opencart:opencart:3.0.3.9:::::::*	3.0.3.9	Vulnerable	OpenCart

cpe:2.3:a:opencart:opencart:3.0.3.9:*:*:*:*:*:*:* Versions 3.0.3.9 Vulnerable ·OpenCart

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2024-21514
2026-10-03 Alias added: GHSA-7crj-24g3-g7h7

References

Patch 1

https://github.com/opencart/opencart/commit/46bd5f5a8056ff9aad0aa7d71729c4cf593d67e2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-21514

Other 2

TI-2023-21572 OpenCart CMS v4.0.2.2 was discovered to lack a protective mechanism on its login page… CVSS 3.1CRITICAL 9.8
TI-2024-38428 OpenCart Core 4.0.2.3 SQL Injection via search Parameter CVSS 4.0HIGH 8.8
TI-2023-25651 An issue discovered in OpenCart 4.0.0.0 to 4.0.2.3 allows authenticated backend users… CVSS 3.1HIGH 8.8
TI-2023-02171 Improper input validation in Opencart CVSS 3.1HIGH 8.8
TI-2024-24380 OpenCart 4.0.2.3 is vulnerable to Server-Side Template Injection (SSTI) via the Theme Editor Function. CVSS 3.1HIGH 7.2
TI-2024-14275 Improper input validation in opencart/opencart CVSS 3.1HIGH 7.2

See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences