PT-2026-39504 · Opencart · Tmd Vendor System

Published 2026-05-10 · Updated 2026-05-10 · CVE-2021-47928

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Opencart TMD Vendor System versions 3.x

Description A blind SQL injection allows unauthenticated attackers to extract database information. By injecting SQL code through the product id parameter, attackers can use time-based or content-based blind injection techniques to enumerate usernames, emails, and password reset codes from the oc user table. Blind SQL injection is a technique where the attacker asks the database true/false questions and determines the answer based on the application's response or the time it takes to respond.

Recommendations Update Opencart TMD Vendor System versions 3.x to the patched version. As a temporary workaround, restrict or sanitize input for the product id parameter to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-47928

Affected Products

Tmd Vendor System

References · 6

• 🔥 https://exploit-db.com/exploits/50493 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-47928 · Security Note
• https://vulncheck.com/advisories/opencart-tmd-vendor-system-3-x-blind-sql-injection-via-product-route · Note
• https://opencartextensions.in · Note
• https://twitter.com/0x2ed3bb60/status/2053472672986898557 · Twitter Post
• https://opencartextensions.in/opencart-multi-vendor-multi-seller-marketplace · Note