CVE-2024-24308

2024-02-0900:00:00

mitre

github.com

sql injection

boostmyshop

prestashop

remote attackers

privilege escalation

sensitive information

vulnerability

AI Score

Confidence

Low

SSVC

Exploitation

none

Automatable

yes

Technical Impact

total

JSON

SQL Injection vulnerability in Boostmyshop (boostmyshopagent) module for Prestashop versions 1.1.9 and before, allows remote attackers to escalate privileges and obtain sensitive information via changeOrderCarrier.php, relayPoint.php, and shippingConfirmation.php.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:boostmyshop:boostmyshop:*:*:*:*:*:*:*:*"
    ],
    "vendor": "boostmyshop",
    "product": "boostmyshop",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "1.1.9"
      }
    ],
    "defaultStatus": "unknown"
  }
]