Opencart TMD Vendor System 3.x contains a blind SQL injection flaw in the product_id parameter of the product route. The vulnerability allows an unauthenticated attacker to inject and execute SQL code that is hidden from the user response, using time‑based or content‑based techniques. Successful exploitation can reveal sensitive data such as usernames, email addresses, and password reset codes stored in the oc_user table, which directly compromises the confidentiality of the application’s user database.

Vendors affected include opencartextensions, specifically the Extension TMD Vendor System. The vulnerability impacts version 3.x of the plugin, though the precise release build is not listed. All installations using this version without the corresponding fix are susceptible.

The CVSS score of 8.8 indicates a high severity. Without an EPSS score, the historical exploitation probability is unknown, but the flaw is unauthenticated and can be triggered via standard HTTP requests to the product route, making it widely exploitable from any network location. The vulnerability is not currently listed in CISA’s KEV catalog. Attackers can leverage automated blind injection tools to enumerate database contents, leading to potential credential compromise and further lateral movement within the system.