Vulnerability · Published Jan 20, 2025 · Assigned by VulDB

CVE-2025-0579Shiprocket Module REST API Module restapi sql injection

High 7.3

In plain English

A high-severity SQL injection in Shiprocket Module. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.4%top 65.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in Shiprocket Module 3/4 on OpenCart. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /index.php?route=extension/shiprocket/module/restapi of the component REST API Module. The manipulation of the argument x-username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
n/a	Shiprocket Module	34

Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References

VDB-292597 | Shiprocket Module REST API Module restapi sql injection vdb-entry, technical-description
VDB-292597 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #476831 | ShipRocket OpenCart module v3 and v4 SQL Injection third-party-advisory
https://gist.github.com/mcdruid/3c9fc9bd4e882cee21f8a37998f56fce exploit