CVE-2024-21514: 
PHP vulnerability analysis and mitigation

CVE-2024-21514 is a SQL Injection vulnerability discovered in the Divido payment extension for OpenCart, which is included by default in version 3.0.3.9. The vulnerability affects the package opencart/opencart from version 0.0.0 and was disclosed on June 22, 2024. This security flaw allows anonymous unauthenticated users to exploit SQL injection vulnerabilities in the payment module, even if it's not enabled, as long as it's installed (Snyk Advisory).

The vulnerability has been assigned a CVSS v3.1 Base Score of 8.1 (HIGH) by NVD with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-89 (SQL Injection). The issue specifically exists in the Divido payment extension's update functionality, which can be exploited through a POST request to /index.php?route=extension/payment/divido/update endpoint (NVD).

The vulnerability allows any unauthenticated user to potentially dump the entire OpenCart database, including customer PII (Personally Identifiable Information) data. This represents a significant security risk as it could lead to unauthorized access to sensitive customer information and potential data breaches (Snyk Advisory).

The vulnerability has been addressed by completely removing the Divido payment extension from OpenCart. Users should upgrade to OpenCart version 3.0.4.0 or higher to mitigate this vulnerability (Github Patch).