An unauthenticated SQL injection vulnerability in the Opencart TMD Vendor System extension allows remote attackers to compromise database integrity.

This is a classic SQL injection (CWE-89) flaw where the application fails to properly neutralize special elements in an SQL command. The vulnerability is exploitable by unauthenticated remote attackers via the product route.

Successful exploitation allows an attacker to execute arbitrary SQL commands, potentially leading to unauthorized data exfiltration or modification. Given the CVSS score of 8.2, this represents a significant risk to the confidentiality and integrity of the e-commerce platform and associated customer data.

Immediate Action: Contact the vendor (Opencart Extensions) to verify the availability of a security update; if no patch is available, remove or disable the extension immediately.

Proactive Monitoring: Monitor database query logs for unusual syntax, such as UNION SELECT statements or unexpected error patterns, which may indicate automated scanning or exploitation.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules configured to inspect the product route parameters.

Public Exploit Available: Yes — a public exploit is available via ExploitDB (ID 50493).

Due to the availability of a public exploit and the high severity of SQL injection vulnerabilities, immediate action is required. Organizations using the Opencart TMD Vendor System should prioritize auditing their installations and applying any available vendor patches or disabling the vulnerable component entirely.