In the module "Cross Selling in Modal Cart" (motivationsale) < 3.5.0 from MyPrestaModules for PrestaShop, a guest can perform SQL injection. The method `motivationsaleDataModel::getProductsByIds()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 08:28
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://addons.prestashop.com/fr/ventes-croisees-packs-produits/16122-cross-selling-in-modal-cart.html - Product | |
| References | () https://security.friendsofpresta.org/modules/2023/11/21/motivationsale.html - Patch, Third Party Advisory |
30 Nov 2023, 05:25
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://security.friendsofpresta.org/modules/2023/11/21/motivationsale.html - Patch, Third Party Advisory | |
| References | () https://addons.prestashop.com/fr/ventes-croisees-packs-produits/16122-cross-selling-in-modal-cart.html - Product | |
| CWE | CWE-89 | |
| First Time |
Myprestamodules
Myprestamodules cross Selling In Modal Cart |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CPE | cpe:2.3:a:myprestamodules:cross_selling_in_modal_cart:*:*:*:*:*:prestashop:*:* |
22 Nov 2023, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-11-22 18:15
Updated : 2024-11-21 08:28
NVD link : CVE-2023-46357
Mitre link : CVE-2023-46357
CVE.ORG link : CVE-2023-46357
JSON object : View
Products Affected
myprestamodules
- cross_selling_in_modal_cart
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')