CVE-2021-37823: 
PHP vulnerability analysis and mitigation

OpenCart 3.0.3.7 contains a SQL injection vulnerability that allows authenticated users with admin access to obtain database information or read server files through SQL injection in the background (Medium Blog). The vulnerability was discovered in July 2021 and assigned CVE-2021-37823 (NVD).

The vulnerability exists in the backup/restore functionality of OpenCart's admin panel. An authenticated admin user can exploit this by uploading a maliciously crafted SQL file containing payloads like 'updatexml()' or time-based injection techniques through the system maintenance restore feature. The vulnerability has a CVSS v3.1 base score of 4.9 (Medium) with vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N (NVD).

Successful exploitation allows attackers to obtain sensitive database information or read server files through SQL injection techniques like LOAD_FILE(). The vulnerability primarily impacts data confidentiality, allowing unauthorized access to database contents and potentially sensitive server files (Medium Blog).

The vulnerability requires valid admin credentials to access the backend system maintenance features. A proof-of-concept exploit exists demonstrating SQL injection through the backup/restore functionality using payloads like 'updatexml()' function or time-based techniques (Medium Blog).

Users should upgrade to a version newer than OpenCart 3.0.3.7 that contains fixes for this vulnerability. Additionally, access to admin panel functionality should be strictly limited and monitored (NVD).