CVE-2016-10509

2017-08-3120:29:00

Google

osv.dev

8.2 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

44.2%

JSON

SQL injection vulnerability in the updateAmazonOrderTracking function in upload/admin/model/openbay/amazon.php in OpenCart before version 2.3.0.0 allows remote authenticated administrators to execute arbitrary SQL commands via a carrier (aka courier_id) parameter to openbay.php.

CPENameOperatorVersion
opencarteq2.0.1.1
opencarteq2.0.2.0
opencarteq2.1.0.0
opencarteq2.2.0.0
opencarteq2.0.3.1
opencarteq2.0.1.0
opencarteq2.0.0.0
opencarteq2.1.0.1
opencarteq2.0.3.0

Name	Operator	Version
opencart	eq	2.0.1.1
opencart	eq	2.0.2.0
opencart	eq	2.1.0.0
opencart	eq	2.2.0.0
opencart	eq	2.0.3.1
opencart	eq	2.0.1.0
opencart	eq	2.0.0.0
opencart	eq	2.1.0.1
opencart	eq	2.0.3.0