CVE-2024-25846

2024-02-2700:00:00

mitre

github.com

cve-2024-25846

product catalog import

file upload

php extension

security vulnerability

myprestamodules

prestashop

AI Score

Confidence

Low

SSVC

Exploitation

none

Automatable

yes

Technical Impact

total

JSON

In the module “Product Catalog (CSV, Excel) Import” (simpleimportproduct) <= 6.7.0 from MyPrestaModules for PrestaShop, a guest can upload files with extensions .php.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:myprestamodules:simpleimportproduct:*:*:*:*:*:*:*:*"
    ],
    "vendor": "myprestamodules",
    "product": "simpleimportproduct",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "6.7.0"
      }
    ],
    "defaultStatus": "unknown"
  }
]