Lucene search

[email protected]NVD:CVE-2023-47308

HistoryNov 15, 2023 - 1:15 a.m.

CVE-2023-47308

2023-11-1501:15:07

CWE-89

[email protected]

web.nvd.nist.gov

cve-2023-47308

newsletter popup pro

active design

prestashop

sql injection

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

33.0%

JSON

In the module “Newsletter Popup PRO with Voucher/Coupon code” (newsletterpop) before version 2.6.1 from Active Design for PrestaShop, a guest can perform SQL injection in affected versions. The method NewsletterpopsendVerificationModuleFrontController::checkEmailSubscription() has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.

Affected configurations

Nvd

Node

activedesignnewsletterpopRange2.3.1–2.4.53prestashop

activedesignnewsletterpopRange2.5.2–2.6.1prestashop

VendorProductVersionCPE
activedesignnewsletterpop*cpe:2.3:a:activedesign:newsletterpop:*:*:*:*:*:prestashop:*:*

Vendor	Product	Version	CPE
activedesign	newsletterpop	*	cpe:2.3:a:activedesign:newsletterpop::::::prestashop::*

References

github.com/friends-of-presta/security-advisories/blob/main/_posts/2023-11-09-newsletterpop.md

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

33.0%

JSON

Related for NVD:CVE-2023-47308

prion1 vulnrichment1 cvelist1 cve1