CVE-2021-37823

Description

OpenCart 3.0.3.7 allows users to obtain database information or read server files through SQL injection in the background.

How to fix CVE-2021-37823

No fixed version has been published yet. Mitigate by removing the affected package or applying upstream guidance from the references below.

• Packagist/opencart/opencart—no fix listed

Is CVE-2021-37823 being exploited?

Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, <= 3.0.3.7

CVSS scores

References (3)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-37823
• PATCHgithub.com/opencart/opencart
• WEBmedium.com/@nowczj/sql-injection-exists-in-the-background-of-opencart-d41b5c58e99e