In the module "Product Catalog (CSV, Excel, XML) Export PRO" (exportproducts) in versions up to 5.0.0 from MyPrestaModules for PrestaShop, a guest can perform SQL injection via `exportProduct::_addDataToDb().`
References
Configurations
History
21 Nov 2024, 08:26
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://addons.prestashop.com/en/data-import-export/18662-product-catalog-csv-excel-xml-export-pro.html - Product | |
| References | () https://security.friendsofpresta.org/modules/2023/11/16/exportproducts.html - Patch, Third Party Advisory |
25 Nov 2023, 02:15
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:myprestamodules:exportproducts:*:*:*:*:*:prestashop:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CWE | CWE-89 | |
| First Time |
Myprestamodules
Myprestamodules exportproducts |
|
| References | () https://addons.prestashop.com/en/data-import-export/18662-product-catalog-csv-excel-xml-export-pro.html - Product | |
| References | () https://security.friendsofpresta.org/modules/2023/11/16/exportproducts.html - Patch, Third Party Advisory |
17 Nov 2023, 02:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-11-17 02:15
Updated : 2024-11-21 08:26
NVD link : CVE-2023-45387
Mitre link : CVE-2023-45387
CVE.ORG link : CVE-2023-45387
JSON object : View
Products Affected
myprestamodules
- exportproducts
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')