In the module "Jms Setting" (jmssetting) from Joommasters for PrestaShop, a guest can perform SQL injection in versions <= 1.1.0. The method `JmsSetting::getSecondImgs()` has a sensitive SQL call that can be executed with a trivial http call and exploited to forge a blind SQL injection.
References
| Link | Resource |
|---|---|
| https://security.friendsofpresta.org/modules/2024/01/16/jmssetting.html | Exploit Patch Third Party Advisory |
| https://www.joommasters.com/ | Product |
| https://security.friendsofpresta.org/modules/2024/01/16/jmssetting.html | Exploit Patch Third Party Advisory |
| https://www.joommasters.com/ | Product |
Configurations
History
21 Nov 2024, 08:36
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://security.friendsofpresta.org/modules/2024/01/16/jmssetting.html - Exploit, Patch, Third Party Advisory | |
| References | () https://www.joommasters.com/ - Product |
25 Jan 2024, 17:10
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CWE | CWE-89 | |
| References | () https://security.friendsofpresta.org/modules/2024/01/16/jmssetting.html - Exploit, Patch, Third Party Advisory | |
| References | () https://www.joommasters.com/ - Product | |
| CPE | cpe:2.3:a:joommasters:jmssetting:*:*:*:*:*:prestashop:*:* | |
| First Time |
Joommasters jmssetting
Joommasters |
19 Jan 2024, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-01-19 14:15
Updated : 2024-11-21 08:36
NVD link : CVE-2023-50030
Mitre link : CVE-2023-50030
CVE.ORG link : CVE-2023-50030
JSON object : View
Products Affected
joommasters
- jmssetting
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')