CVE-2017-20282
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The jCart component for OpenCart 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the product_id parameter.
Risk Assessment
Attackers can send GET requests to index.php with the appropriate parameters, which may lead to the disclosure of sensitive database information.
Recommendation
It is recommended to update the jCart component to the latest version and implement input data filtering and validation to minimize the risk of SQL injection.
Original NVD description (English source)
Joomla! Component jCart for OpenCart 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the product_id parameter. Attackers can send GET requests to index.php with the option=com_jcart&route=product/product parameters and malicious product_id values to extract sensitive database information.