An SQL injection vulnerability in the Payplug (payplug) module for PrestaShop, in versions 3.6.0, 3.6.1, 3.6.2, 3.6.3, 3.7.0 and 3.7.1, allows remote attackers to execute arbitrary SQL commands via the ajax.php front controller.
References
| Link | Resource |
|---|---|
| https://addons.prestashop.com/en/payment-card-wallet/8795--payplug-accept-customer-payments-wherever-they-are.html | Product |
| https://security.friendsofpresta.org/module/2023/07/18/payplug.html | Exploit Patch Third Party Advisory |
| https://addons.prestashop.com/en/payment-card-wallet/8795--payplug-accept-customer-payments-wherever-they-are.html | Product |
| https://security.friendsofpresta.org/module/2023/07/18/payplug.html | Exploit Patch Third Party Advisory |
Configurations
History
21 Nov 2024, 07:59
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://addons.prestashop.com/en/payment-card-wallet/8795--payplug-accept-customer-payments-wherever-they-are.html - Product | |
| References | () https://security.friendsofpresta.org/module/2023/07/18/payplug.html - Exploit, Patch, Third Party Advisory |
27 Jul 2023, 03:55
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Prestashop
Prestashop payplug |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CWE | CWE-89 | |
| CPE | cpe:2.3:a:prestashop:payplug:*:*:*:*:*:prestashop:*:* | |
| References | (MISC) https://addons.prestashop.com/en/payment-card-wallet/8795--payplug-accept-customer-payments-wherever-they-are.html - Product | |
| References | (MISC) https://security.friendsofpresta.org/module/2023/07/18/payplug.html - Exploit, Patch, Third Party Advisory |
18 Jul 2023, 19:49
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-07-18 19:15
Updated : 2024-11-21 07:59
NVD link : CVE-2023-30153
Mitre link : CVE-2023-30153
CVE.ORG link : CVE-2023-30153
JSON object : View
Products Affected
prestashop
- payplug
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')