OpenCart Core 4.0.2.3 is vulnerable to an unauthenticated SQL injection via the search parameter on the product search endpoint. An attacker can send specially crafted GET requests containing malicious SQL code that exploits insufficient input validation. The flaw allows boolean‑based blind or time‑based injection techniques, giving the attacker the ability to read sensitive data from the database, such as customer details and order information, thereby compromising confidentiality. The vulnerability is classified as CWE‑89 (SQL Injection).

The affected product is Opencart OpenCart Core, specifically versions 4.0.2.3 and potentially 4.1.0.0 which contains the same code path. Systems running these versions without the latest patch are at risk.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% suggests that exploitation is currently unlikely in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation can occur without authentication by sending a crafted GET request to the search endpoint, meaning that any remote visitor could potentially enumerate database contents if the attack is successful.