In the module mib < 1.6.1 from MyPresta.eu for PrestaShop, a guest can perform SQL injection. The methods `mib::getManufacturersByCategory()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.
References
| Link | Resource |
|---|---|
| https://mypresta.eu/modules/front-office-features/manufacturers-brands-images-block.html | Product |
| https://security.friendsofpresta.org/modules/2024/01/18/mib.html | Patch Third Party Advisory |
| https://mypresta.eu/modules/front-office-features/manufacturers-brands-images-block.html | Product |
| https://security.friendsofpresta.org/modules/2024/01/18/mib.html | Patch Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 08:28
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://mypresta.eu/modules/front-office-features/manufacturers-brands-images-block.html - Product | |
| References | () https://security.friendsofpresta.org/modules/2024/01/18/mib.html - Patch, Third Party Advisory |
25 Jan 2024, 20:14
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-89 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CPE | cpe:2.3:a:mypresta:manufacturers_\(brands\)_images_block:*:*:*:*:*:prestashop:*:* | |
| First Time |
Mypresta manufacturers \(brands\) Images Block
Mypresta |
|
| References | () https://security.friendsofpresta.org/modules/2024/01/18/mib.html - Patch, Third Party Advisory | |
| References | () https://mypresta.eu/modules/front-office-features/manufacturers-brands-images-block.html - Product |
19 Jan 2024, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-01-19 14:15
Updated : 2024-11-21 08:28
NVD link : CVE-2023-46351
Mitre link : CVE-2023-46351
CVE.ORG link : CVE-2023-46351
JSON object : View
Products Affected
mypresta
- manufacturers_\(brands\)_images_block
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')