CVE-2025-0579
Published: 20 January 2025
Summary
CVE-2025-0579 is a medium-severity Injection (CWE-74) vulnerability. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-0579 is a SQL injection vulnerability affecting Shiprocket Module versions 3 and 4 on OpenCart. The issue resides in an unknown functionality of the REST API Module, specifically the file /index.php?route=extension/shiprocket/module/restapi, where manipulation of the x-username argument triggers the injection. It carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and maps to CWEs 74 (Improper Neutralization of Special Elements used in an SQL Command) and 89 (SQL Injection).
Remote attackers require no privileges, authentication, or user interaction to exploit this vulnerability with low attack complexity. Successful exploitation enables limited impacts on confidentiality, integrity, and availability, allowing potential unauthorized access, modification, or disruption of database contents via injected SQL payloads.
VulDB advisories indicate the vendor was contacted early regarding the disclosure but provided no response. No patches or official mitigations are referenced, and the exploit has been publicly disclosed, including details available via a GitHub Gist. Security practitioners should monitor for updates and consider restricting access to the affected endpoint.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-1775
Vulnerability details
A vulnerability was found in Shiprocket Module 3/4 on OpenCart. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /index.php?route=extension/shiprocket/module/restapi of the component REST API Module. The manipulation of the argument x-username…
more
leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote exploitation of unauthenticated SQL injection in a public REST API endpoint of a web application (OpenCart module).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses SQL injection by requiring validation and sanitization of untrusted inputs like the x-username argument before incorporation into SQL queries.
Ensures timely remediation of identified flaws such as the SQL injection vulnerability in the Shiprocket REST API module through patching or code correction.
Boundary protection with web application firewalls monitors and blocks malicious SQL injection payloads targeting the unauthenticated REST API endpoint.