CVE-2023-30154

2023-10-1400:00:00

mitre

github.com

sqlinjection

aftermail

prestashop

AI Score

8.1

Confidence

Low

SSVC

Exploitation

none

Automatable

yes

Technical Impact

total

JSON

Multiple improper neutralization of SQL parameters in module AfterMail (aftermailpresta) for PrestaShop, before version 2.2.1, allows remote attackers to perform SQL injection attacks via id_customer, id_conf, id_product and token parameters in `aftermailajax.php via the ‘id_product’ parameter in hooks DisplayRightColumnProduct and DisplayProductButtons.