CVE-2024-21514 in the critical feed json
SQL injection in opencart
published 2024-06-22 2 y ago modified 2026-06-17 4 mo ago also GHSA-7crj-24g3-g7h7 , EUVD-2024-1960
- cvss
- 7.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 19.1%
- EPSS 19.1% chance of exploitation in 30 days, percentile 97%
- public exploits
- 0
- none known
Summary
This affects versions of the package opencart/opencart from 0.0.0. An SQL Injection issue was identified in the Divido payment extension for OpenCart, which is included by default in version 3.0.3.9. As an anonymous unauthenticated user, if the Divido payment module is installed (it does not have to be enabled), it is possible to exploit SQL injection to gain unauthorised access to the backend database. For any site which is vulnerable, any unauthenticated user could exploit this to dump the entire OpenCart database, including customer PII data.
Patch / fix
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
19.08% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- security.snyk.io https://security.snyk.io/vuln/SNYK-PHP-OPENCARTOPENCART-7266565 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H/E:P |
| CNA | 3.1 | 7.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H |
| NVD | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 7.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | opencart/opencart | <=3.0.3.9 |
no fix listed |
Affected products
- n/a opencart/opencart
- opencart opencart
Classification
- Weakness
-
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
-
github.com
/opencart/opencart/commit/46bd5f5a8056ff9aad0aa7d71729c4cf593d67e2
web, patch
-
security.snyk.io
/vuln/SNYK-PHP-OPENCARTOPENCART-7266565
web, exploit, patch, third-party-advisory
-
github.com
/opencart/opencart/blob/3.0.3.9/upload/catalog/model/extension/payment/divido.php%23L114
web, product
-
nvd.nist.gov
/vuln/detail/CVE-2024-21514
advisory
-
github.com
/opencart/opencart
package
Sources
- CVE List CVE-2024-21514
- GitHub Advisory GHSA-7crj-24g3-g7h7
- NVD CVE-2024-21514
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.