Shiprocket OpenCart Module SQL Injection Vulnerability

A critical SQL injection vulnerability has been identified in the Shiprocket module for OpenCart, specifically in versions 3 and 4. The issue arises in the REST API module's endpoint, where the 'x-username' header can be manipulated to execute arbitrary SQL commands. This vulnerability allows remote attackers to access and exfiltrate sensitive database information, including admin credentials and personally identifiable information.

Impact

Exploitation of this vulnerability allows for unauthorized access to the database, with the potential to extract admin session details and any stored personally identifiable information or payment details.

Reproduction

The vulnerability can be reproduced by sending a request to the 'index.php?route=extension/shiprocket/module/restapi' endpoint with a crafted 'x-username' header that includes SQL injection payloads. This can be done using tools like curl or sqlmap. The injection takes advantage of error-based or blind SQL injection techniques to extract information from the database.

Remediation

OpenCart modules should validate all input used in SQL queries to prevent injection vulnerabilities. This can be done by casting values to numeric formats or using the database driver's escape method. Shiprocket has been contacted about this vulnerability but has not yet provided a response.