CVE-2023-46358

2023-10-2500:00:00

mitre

github.com

referral and affiliation program

sql injection

snegurka

prestashop

cve-2023-46358

AI Score

7.7

Confidence

Low

EPSS

0.001

Percentile

38.6%

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

total

JSON

In the module “Referral and Affiliation Program” (referralbyphone) version 3.5.1 and before from Snegurka for PrestaShop, a guest can perform SQL injection. Method ReferralByPhoneDefaultModuleFrontController::ajaxProcessCartRuleValidate has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.