Lucene search

MitreCVE-2023-30154

HistoryOct 14, 2023 - 4:15 a.m.

CVE-2023-30154

2023-10-1404:15:11

CWE-89

mitre

web.nvd.nist.gov

cve

2023

30154

prestashop

sql injection

nvd

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.001

Percentile

30.8%

JSON

Multiple improper neutralization of SQL parameters in module AfterMail (aftermailpresta) for PrestaShop, before version 2.2.1, allows remote attackers to perform SQL injection attacks via id_customer, id_conf, id_product and token parameters in `aftermailajax.php via the ‘id_product’ parameter in hooks DisplayRightColumnProduct and DisplayProductButtons.

Affected configurations

Nvd

Node

shoprunnersaftermailRange<2.2.1prestashop

VendorProductVersionCPE
shoprunnersaftermail*cpe:2.3:a:shoprunners:aftermail:*:*:*:*:*:prestashop:*:*

Vendor	Product	Version	CPE
shoprunners	aftermail	*	cpe:2.3:a:shoprunners:aftermail::::::prestashop::*

References

security.friendsofpresta.org/modules/2023/10/10/aftermailpresta.html

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.001

Percentile

30.8%

JSON

Related for CVE-2023-30154