The So Filter Shop By module for OpenCart version 3.x suffers from a remote blind SQL injection vulnerability.