CVE-2024-21514: SQL Injection
This affects versions of the package opencart/opencart from 0.0.0. An SQL Injection issue was identified in the Divido payment extension for OpenCart, which is included by default in version 3.0.3.9. As an anonymous unauthenticated user, if the Divido payment module is installed (it does not have to be enabled), it is possible to exploit SQL injection to gain unauthorised access to the backend database. For any site which is vulnerable, any unauthenticated user could exploit this to dump the entire OpenCart database, including customer PII data.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21514?
CVE-2024-21514 is classified as a high severity SQL Injection vulnerability.
How do I fix CVE-2024-21514?
To fix CVE-2024-21514, update the OpenCart package to a version later than 3.0.3.9.
Which versions are affected by CVE-2024-21514?
CVE-2024-21514 affects OpenCart version 3.0.3.9 and earlier.
What type of vulnerability is CVE-2024-21514?
CVE-2024-21514 is an SQL Injection vulnerability found in the Divido payment extension.
Who can exploit CVE-2024-21514?
CVE-2024-21514 can be exploited by anonymous unauthenticated users if the Divido payment module is installed.