CVE-2023-46349

2023-11-2700:00:00

mitre

www.cve.org

cve-2023-46349

product catalog export/update

sql injection

AI Score

9.9

Confidence

High

EPSS

0.001

Percentile

33.0%

JSON

In the module “Product Catalog (CSV, Excel) Export/Update” (updateproducts) < 3.8.5 from MyPrestaModules for PrestaShop, a guest can perform SQL injection. The method productsUpdateModel::getExportIds() has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.

References

security.friendsofpresta.org/modules/2023/11/23/updateproducts.html