CVE-2023-30153

Опубликовано: 18 июл. 2023

Источник: nvd

CVSS3: 9.8

EPSS Низкий

Описание

An SQL injection vulnerability in the Payplug (payplug) module for PrestaShop, in versions 3.6.0, 3.6.1, 3.6.2, 3.6.3, 3.7.0 and 3.7.1, allows remote attackers to execute arbitrary SQL commands via the ajax.php front controller.

Ссылки

https://addons.prestashop.com/en/payment-card-wallet/8795--payplug-accept-customer-payments-wherever-they-are.html
Product
https://security.friendsofpresta.org/module/2023/07/18/payplug.html
Exploit
Patch
Third Party Advisory
https://addons.prestashop.com/en/payment-card-wallet/8795--payplug-accept-customer-payments-wherever-they-are.html
Product
https://security.friendsofpresta.org/module/2023/07/18/payplug.html
Exploit
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:prestashop:payplug:*:*:*:*:*:prestashop:*:*

Версия от 3.6.0 (включая) до 3.8.2 (исключая)

EPSS

Процентиль: 50%

0.00269

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-89

Связанные уязвимости

GHSA-cxg4-r4px-6qc5