OpenCart, an open-source e-commerce platform, is widely adopted by businesses around the globe for its simplicity and adaptability. As an online store management system, OpenCart stores sensitive data such as customer information, payment details, and purchase history. Therefore, maintaining data integrity and security is of paramount importance.

Recently, a vulnerability has been discovered in OpenCart 3..3.7 (CVE-2021-37823) that enables users to obtain database information or read server files through SQL injection in the background. In this post, we will delve into the details of this vulnerability, the code snippet that triggers it, links to official references, and the steps to exploit it.

Details

The vulnerability, identified as CVE-2021-37823, stems from improper input validation in OpenCart 3..3.7. An attacker can exploit this weakness to perform SQL injection attacks, potentially gaining unauthorized access to sensitive data, modifying data held in the database, or even executing arbitrary commands on the server.

The insecure code snippet in question is present in the extension/extension module. The code does not properly sanitize user-supplied input passed to the user_token parameter, which in turn enables SQL Injection attacks. Here is the problematic code snippet:

if (isset($this->request->get['user_token'])) {
    $url .= '&user_token=' . $this->request->get['user_token'];
}

Official References

You can find the official advisory about this vulnerability and related CVE on OpenCart's GitHub repository and security bulletins from various vulnerability databases:

1. OpenCart GitHub Repository: https://github.com/opencart/opencart/issues/9776
2. CVE Details: https://www.cvedetails.com/cve/CVE-2021-37823/
3. NIST Vulnerability Database: https://nvd.nist.gov/vuln/detail/CVE-2021-37823

Exploit Details

To exploit this vulnerability, an attacker must send a specially crafted request containing malicious SQL code to the vulnerable application. You can do this by using a tool like Burp Suite or manually crafting an HTTP request.

Here's an example of an exploit payload that could be used to extract data from the database

GET /admin/index.php?route=extension/extension&user_token=123-1'%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40--%20- HTTP/1.1


This exploit attempts to inject a UNION SELECT statement into the vulnerable 'user_token' parameter, causing the malicious SQL code to be executed and potentially revealing sensitive data.

It is crucial to note that exploiting this vulnerability may have severe implications, including potential data breaches and unauthorized access to sensitive information. It is recommended to update OpenCart to the latest version or apply any patches provided by the developers.

Conclusion

In this post, we looked into the OpenCart 3..3.7 vulnerability, CVE-2021-37823, which allows users to obtain database information or read server files through a SQL injection. We discussed the code snippet causing the vulnerability, links to official references, and the details of exploiting the vulnerability.

To protect your OpenCart installation from this vulnerability, it is highly suggested to update the system to the latest version or apply security patches provided by the developers. It is also good practice to periodically check for security updates to ensure the continued safety of your e-commerce store and user data.

Timeline

Published on: 11/03/2022 17:15:00 UTC
Last modified on: 12/03/2022 02:54:00 UTC