Vulnerability · Published Mar 25, 2026 · Assigned by VulnCheck

CVE-2024-58341OpenCart Core 4.0.2.3 SQL Injection via search Parameter

High 8.2

In plain English

A high-severity SQL injection in OpenCart Core from Opencart. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.3%top 72.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

OpenCart Core 4.0.2.3 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'search' parameter. Attackers can send GET requests to the product search endpoint with malicious 'search' values to extract sensitive database information using boolean-based blind or time-based blind SQL injection techniques.

Affected products (as reported)

Vendor	Product	Versions
Opencart	OpenCart Core	4.0.2.3

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

References

ExploitDB-51940 exploit
Official Product Homepage product
Product Reference product, patch
VulnCheck Advisory: OpenCart Core 4.0.2.3 SQL Injection via search Parameter third-party-advisory