nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2021-47928 CVE-2021-47928
HIGH
Opencart TMD Vendor System 3.x Blind SQL Injection via product route
Record summary
CVE-2021-47928 has a selected CVSS score of 8.8 (high); EIP currently links 1 catalogued exploit.
Description
Opencart TMD Vendor System 3.x contains a blind SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through the product_id parameter. Attackers can craft malicious SQL queries using time-based or content-based blind injection techniques to enumerate usernames, emails, and password reset codes from the oc_user table.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
CISA SSVC decision
ExploitationPoC
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated May 11, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Extension TMD Vendor SystemBrowse opencartextensions / Extension TMD Vendor System | CVE List | 3.0 | affected |
Proofs of concept
1Catalogued exploits
ExploitDBOpencart 3 Extension TMD Vendor System - Blind SQL InjectionExploitDB exploitby Muhammad Zaki SulistyaNot analyzed1 file
References
5ExploitDB-50493exploit
https://www.exploit-db.com/exploits/50493 Official Product Homepageproduct
https://www.opencartextensions.in/ Product Referenceproduct
https://www.opencartextensions.in/opencart-multi-vendor-multi-seller-marketplace VulnCheck Advisory: Opencart TMD Vendor System 3.x Blind SQL Injection via product routeThird-party advisory
https://www.vulncheck.com/advisories/opencart-tmd-vendor-system-3-x-blind-sql-injection-via-product-route