Security readout for executives and security teams
Plain-English summary
An Opencart marketplace add-on called TMD Vendor System 3.0 has a flaw that lets anyone on the internet pull sensitive data out of the store's database without logging in. Attackers can quietly extract usernames, emails, and password reset codes, which can enable account takeover of administrators and vendors.
Executive priority
Treat as a high-priority remediation for any e-commerce site using this extension. Customer and admin credential data is reachable without authentication, which creates direct fraud, account takeover, and brand-trust risk for the storefront.
Technical view
CVE-2021-47928 is a blind SQL injection (CWE-89) in the product route of Opencart TMD Vendor System 3.x. The product_id parameter is not safely parameterized, allowing time-based and content-based blind injection by an unauthenticated remote attacker. Public sources cite extraction of records from the oc_user table including credentials reset material.
Likely exposure
Internet-facing Opencart storefronts that installed the TMD Vendor System 3.0 multi-vendor marketplace extension. Exposure is highest where the extension is reachable without authentication and where admin or vendor accounts share credentials or recovery emails with other systems.
Exploitation context
A public proof-of-concept exists at ExploitDB (entry 50493) and a VulnCheck advisory describes the issue. The CVE is not listed in CISA KEV at the time of the source bundle, and no confirmed in-the-wild exploitation is cited. CVSS 4.0 base is 8.8 (network, no privileges, no user interaction).
Researcher notes
Single affected product line documented (TMD Vendor System 3.0). Sources describe blind SQLi reaching oc_user, suggesting the injection executes in the storefront database context. No patched version is named in the bundle, so remediation guidance should be confirmed directly with the vendor. KEV status is false; treat exploitation likelihood as plausible given public PoC.
Mitigation direction
- Inventory Opencart stores and confirm whether the TMD Vendor System extension is installed.
- Contact opencartextensions.in for an official patched build or removal guidance.
- Restrict or disable the vulnerable product route at the web server or WAF until patched.
- Rotate admin, vendor, and customer password reset tokens after remediation.
- Apply WAF signatures that block SQL injection patterns on product_id parameters.
- Monitor web logs for anomalous product_id values and time-delay query patterns.
Validation and detection
- Identify installed Opencart extensions and confirm the TMD Vendor System version against 3.0.
- Review web access logs for suspicious product_id payloads or repeated timing-based requests.
- Audit the oc_user table for unexpected reads, new accounts, or recent password reset activity.
- Verify WAF or reverse proxy is logging and blocking SQLi patterns on the affected route.
- Confirm vendor patch availability and version metadata after applying any fix.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-89: Database access and collection lookup
Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-47928 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N——VulnCheckCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N3.94.2VulnCheckVulnerability scoring details
Base CVSS 4.0 score
8.8HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Base CVSS 3.1 score
8.2HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-50493CVE reference, VulnCheck · exploit
- Official Product HomepageCVE reference, VulnCheck · product
- Product ReferenceCVE reference, VulnCheck · product
- VulnCheck Advisory: Opencart TMD Vendor System 3.x Blind SQL Injection via product routeCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.