Threats affecting pkg:github/opencart/opencart

OpenCart versions up to 4.1.0.4 have a business logic vulnerability that allows authenticated customers to place unpaid full-price orders by manipulating reward points after selecting the Free Checkout option. Attackers can apply reward points, save the Free Checkout selection, then submit zero points via the reward.save function, causing the order confirmation process to proceed without payment.

OpenCart Core 4.0.2.3 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'search' parameter. Attackers can send GET requests to the product search endpoint with malicious 'search' values to extract sensitive database information using boolean-based blind or time-based blind SQL injection techniques.