CVE-2024-21514

Summary

CVE-2024-21514 is a new SQL Injection vulnerability that affects versions of the OpenCart package, specifically the Divido payment extension, starting from 0.0.0. This issue is present even when the extension is not enabled. An anonymous attacker can exploit this vulnerability to gain unauthorized access to the backend database of a vulnerable OpenCart site, potentially exposing customer Personally Identifiable Information (PII) data. The Divido payment module, which comes pre-installed with OpenCart version 3.0.3.9, is the source of this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.