CVE-2023-46914

2024-02-0700:00:00

mitre

github.com

sql injection

prestashop

rm bookingcalendar

ics_export.php

remote attackers

arbitrary code

escalate privileges

sensitive information

AI Score

8.5

Confidence

Low

SSVC

Exploitation

none

Automatable

yes

Technical Impact

total

JSON

SQL Injection vulnerability in RM bookingcalendar module for PrestaShop versions 2.7.9 and before, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via ics_export.php.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:bookingcalendar_project:bookingcalendar:*:*:*:*:*:*:*:*"
    ],
    "vendor": "bookingcalendar_project",
    "product": "bookingcalendar",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "2.7.9"
      }
    ],
    "defaultStatus": "unknown"
  }
]