CVE-2021-47928: Opencart TMD Vendor System SQLi Flaw

CVE-2021-47928 Overview

CVE-2021-47928 is a blind SQL injection vulnerability affecting OpenCart TMD Vendor System 3.x, a multi-vendor marketplace extension for the OpenCart e-commerce platform. The flaw resides in the handling of the product_id parameter exposed through the product route. Unauthenticated attackers can inject SQL payloads using time-based or boolean-based blind techniques. Successful exploitation enables extraction of sensitive records from the oc_user table, including usernames, email addresses, and password reset codes. The weakness is classified as Improper Neutralization of Special Elements used in an SQL Command [CWE-89].

Critical Impact

Unauthenticated attackers can extract administrative credentials and password reset codes from the OpenCart database, enabling full takeover of vendor and administrative accounts.

Affected Products

• OpenCart TMD Vendor System 3.x
• OpenCart Multi-Vendor / Multi-Seller Marketplace extension
• OpenCart deployments installing the TMD Vendor System plugin

Discovery Timeline

• 2026-05-10 - CVE-2021-47928 published to the National Vulnerability Database
• 2026-05-12 - Last updated in NVD database

Technical Details for CVE-2021-47928

Vulnerability Analysis

The vulnerability is a blind SQL injection in the TMD Vendor System extension for OpenCart. The product_id parameter, supplied through the product route, is concatenated into a SQL query without parameterization or sufficient sanitization. Because the application does not return verbose database errors or direct query output, attackers must rely on blind extraction techniques. Two practical approaches are viable: time-based injection using functions such as SLEEP() to infer values from response latency, and boolean-based injection using conditional expressions that alter page content. Both techniques allow byte-by-byte extraction of database contents through repeated requests.

Root Cause

The root cause is the absence of prepared statements or parameter binding when constructing SQL queries from the product_id value. The extension trusts user-controlled input as a numeric identifier without enforcing type validation or escaping, allowing SQL syntax to break out of the intended query context [CWE-89].

Attack Vector

Exploitation occurs over the network and requires no authentication or user interaction. An attacker issues crafted HTTP GET requests to the product route, embedding SQL payloads in the product_id parameter. Using conditional logic against tables such as oc_user, the attacker iteratively reconstructs column values including username, email, and code fields used for password resets. Recovered reset codes can be leveraged to seize administrator accounts and pivot to full marketplace compromise. Technical details and a proof-of-concept are documented in the Exploit-DB entry #50493 and the VulnCheck Advisory on SQL Injection.

Detection Methods for CVE-2021-47928

Indicators of Compromise

• HTTP requests to the OpenCart product route containing SQL keywords such as SELECT, UNION, SLEEP, BENCHMARK, or CASE WHEN within the product_id parameter.
• Abnormally long response times for requests to product endpoints, indicating time-based blind injection probing.
• Large volumes of near-identical requests differing only by character or position values, consistent with byte-by-byte extraction.
• Unexpected reads against the oc_user table in database query logs, particularly involving the code, email, or username columns.

Detection Strategies

• Inspect web server access logs for non-numeric or encoded payloads supplied to product_id query parameters.
• Deploy web application firewall rules that flag SQL metacharacters and time-delay functions in product route parameters.
• Correlate database slow-query logs with web request logs to identify injection-induced latency.

Monitoring Recommendations

• Enable verbose logging on the OpenCart database connection and alert on queries referencing oc_user originating from product controllers.
• Monitor for password reset events that follow anomalous query patterns against the user table.
• Track repeated 200-OK responses to the product route from a single source IP at high frequency.

How to Mitigate CVE-2021-47928

Immediate Actions Required

• Disable or remove the TMD Vendor System 3.x extension until a vendor-supplied patch is verified and applied.
• Rotate all OpenCart administrator and vendor passwords and invalidate outstanding password reset codes in the oc_user table.
• Restrict access to the product route through WAF policies that reject non-integer values for product_id.

Patch Information

No vendor advisory or fixed version has been published in the enriched CVE data. Operators should consult the OpenCart Extensions Homepage and the OpenCart Multi-Vendor Marketplace product page for updated builds, and review the VulnCheck Advisory on SQL Injection for remediation guidance.

Workarounds

• Enforce strict server-side type validation that rejects any non-integer product_id value before it reaches the database layer.
• Place the OpenCart storefront behind a web application firewall with rules blocking SQL injection signatures targeting the product route.
• Apply least-privilege database accounts so the OpenCart application cannot read sensitive columns such as code from oc_user unless required.
• Audit and remove unused vendor and administrator accounts to reduce the impact of credential extraction.