CVE-2024-21514

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

This affects versions of the package opencart/opencart from 0.0.0. An SQL Injection issue was identified in the Divido payment extension for OpenCart, which is included by default in version 3.0.3.9. As an anonymous unauthenticated user, if the Divido payment module is installed (it does not have to be enabled), it is possible to exploit SQL injection to gain unauthorised access to the backend database. For any site which is vulnerable, any unauthenticated user could exploit this to dump the entire OpenCart database, including customer PII data.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Jun 22, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-215154.7This affects versions of the package opencart/opencart from 4.0.0.0. A reflected XSS issue was identified in the filename parameter of the aCVE-2024-215164.7This affects versions of the package opencart/opencart from 4.0.0.0 and before 4.1.0.0. A reflected XSS issue was identified in the directorCVE-2024-215176.1This affects versions of the package opencart/opencart from 4.0.0.0. A reflected XSS issue was identified in the redirect parameter of custoCVE-2024-215187.2This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the marketplace installer due to imCVE-2024-215197.2This affects versions of the package opencart/opencart from 4.0.0.0. An Arbitrary File Creation issue was identified via the database restorCVE-2024-21529.8A vulnerability, which was classified as critical, has been found in SourceCodester Online Mobile Management Store 1.0. Affected by this issCVE-2024-215206.1Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template fCVE-2024-215217.5All versions of the package @discordjs/opus are vulnerable to Denial of Service (DoS) due to providing an input object with a property toStrCVE-2024-215227.5All versions of the package audify are vulnerable to Improper Validation of Array Index when frameSize is provided to the new OpusDecoder().CVE-2024-215237.5All versions of the package images are vulnerable to Denial of Service (DoS) due to providing unexpected input types to several different fuCVE-2024-215249.1All versions of the package node-stringbuilder are vulnerable to Out-of-bounds Read due to incorrect memory length calculation, by calling TCVE-2024-215258.3All versions of the package node-twain are vulnerable to Improper Check or Handling of Exceptional Conditions due to the length of the sourc
CVE-2024-21514: High severity, CVSS 8.1 | Vulnix