Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2023-46357

Опубликовано: 22 нояб. 2023
Источник: nvd
CVSS3: 9.8
EPSS Низкий

Описание

In the module "Cross Selling in Modal Cart" (motivationsale) < 3.5.0 from MyPrestaModules for PrestaShop, a guest can perform SQL injection. The method motivationsaleDataModel::getProductsByIds() has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.

Ссылки

Уязвимые конфигурации

Конфигурация 1
cpe:2.3:a:myprestamodules:cross_selling_in_modal_cart:*:*:*:*:*:prestashop:*:*
Версия до 3.5.0 (исключая)

EPSS

Процентиль: 23%
0.00076
Низкий

9.8 Critical

CVSS3

Дефекты

CWE-89

Связанные уязвимости

github логотип

GHSA-727q-cgw3-7hx2

CVSS3: 9.8
github
около 2 лет назад

In the module "Cross Selling in Modal Cart" (motivationsale) < 3.5.0 from MyPrestaModules for PrestaShop, a guest can perform SQL injection. The method `motivationsaleDataModel::getProductsByIds()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.

EPSS

Процентиль: 23%
0.00076
Низкий

9.8 Critical

CVSS3

Дефекты

CWE-89