CVE-2023-50029

2024-06-2400:00:00

mitre

github.com

php

injection

vulnerability

m4 pdf extensions

arbitrary code

AI Score

7.8

Confidence

Low

SSVC

Exploitation

none

Automatable

yes

Technical Impact

total

JSON

PHP Injection vulnerability in the module “M4 PDF Extensions” (m4pdf) up to version 3.3.2 from PrestaAddons for PrestaShop allows attackers to run arbitrary code via the M4PDF::saveTemplate() method.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:prestashop:m4_pdf:*:*:*:*:*:prestashop:*:*"
    ],
    "vendor": "prestashop",
    "product": "m4_pdf",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "3.3.1"
      }
    ],
    "defaultStatus": "unknown"
  }
]