CVE-2023-47308

2023-11-1500:00:00

mitre

github.com

newsletter popup

sql injection

prestashop

AI Score

Confidence

Low

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

total

JSON

In the module “Newsletter Popup PRO with Voucher/Coupon code” (newsletterpop) before version 2.6.1 from Active Design for PrestaShop, a guest can perform SQL injection in affected versions. The method NewsletterpopsendVerificationModuleFrontController::checkEmailSubscription() has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:prestashop:newsletter_popup_pro:*:*:*:*:*:*:*:*"
    ],
    "vendor": "prestashop",
    "product": "newsletter_popup_pro",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "2.61",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]