CVE-2020-20491: SQL Injection
Published Jun 20, 2023
·Updated
SQL injection vulnerability in OpenCart v.2.2.00 thru 3.0.3.2 allows a remote attacker to execute arbitrary code via the Fba plugin function in upload/admin/index.php.
Affected Software
1 affected component
OpenCart OpenCart>=2.2.00<=3.0.3.2
Event History
Jun 20, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is CVE-2020-20491?
CVE-2020-20491 is a SQL injection vulnerability in OpenCart v.2.2.00 thru 3.0.3.2 that allows a remote attacker to execute arbitrary code.
2
How severe is CVE-2020-20491?
CVE-2020-20491 has a severity value of 7.2 (high).
3
Which software versions are affected by CVE-2020-20491?
OpenCart versions 2.2.00 through 3.0.3.2 are affected by CVE-2020-20491.
4
How can a remote attacker exploit CVE-2020-20491?
A remote attacker can exploit CVE-2020-20491 by sending malicious SQL queries through the Fba plugin function in upload/admin/index.php.
5
Is there a fix available for CVE-2020-20491?
Yes, there is a fix available for CVE-2020-20491. It is recommended to update to a version of OpenCart that is not affected by the vulnerability.