Executive brief
The TMD Vendor System, a popular multi-vendor marketplace extension for OpenCart, contains a security flaw that allows unauthorized individuals to access sensitive database information. By sending specially crafted web requests, an attacker can bypass security controls to extract private data such as usernames, email addresses, and password reset codes. This could lead to full account takeovers of administrators or vendors, potentially resulting in unauthorized store changes, data theft, or financial fraud.
Technical details
A blind SQL injection vulnerability exists in the OpenCart TMD Vendor System extension (3.x) due to improper neutralization of the 'product_id' parameter within the product route. An unauthenticated remote attacker can exploit this by sending crafted SQL queries using time-based or content-based (boolean) blind injection techniques. Successful exploitation allows the attacker to enumerate and extract sensitive data from the 'oc_user' table, including usernames, emails, and password reset tokens. This vulnerability was reportedly patched in newer versions of the extension.
Affected products
- OpenCart Extensions (TMD) TMD Vendor System (Multi Vendor Marketplace) 3.x
Timeline
- 2021-11-03: disclosed: Initial discovery and exploit development by researcher
- 2021-11-04: other: Exploit published to Exploit-DB
- 2026-05-10: advisory: NVD/VulnCheck advisory published