OpenCart Core 4.0.2.3 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through …

OpenCart Core version 4.0.2.3 contains a SQL injection vulnerability in the search parameter that allows unauthenticated attackers to manipulate database queries. Attackers can exploit this vulnerability by sending GET requests to the product search endpoint with malicious search values. The vulnerability enables extraction of sensitive database information through boolean-based blind or time-based blind SQL injection techniques. This is a high-severity vulnerability as it requires no authentication and can lead to complete database compromise. The vulnerability affects the core OpenCart e-commerce platform used by many online retailers.