Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2023-47308

Опубликовано: 15 нояб. 2023
Источник: nvd
CVSS3: 9.8
EPSS Низкий

Описание

In the module "Newsletter Popup PRO with Voucher/Coupon code" (newsletterpop) before version 2.6.1 from Active Design for PrestaShop, a guest can perform SQL injection in affected versions. The method NewsletterpopsendVerificationModuleFrontController::checkEmailSubscription() has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:activedesign:newsletterpop:*:*:*:*:*:prestashop:*:*
Версия от 2.3.1 (включая) до 2.4.53 (включая)
cpe:2.3:a:activedesign:newsletterpop:*:*:*:*:*:prestashop:*:*
Версия от 2.5.2 (включая) до 2.6.1 (исключая)

EPSS

Процентиль: 30%
0.00109
Низкий

9.8 Critical

CVSS3

Дефекты

CWE-89

Связанные уязвимости

github логотип

GHSA-pr7r-v23g-7m8q

CVSS3: 9.8
github
около 2 лет назад

In the module "Newsletter Popup PRO with Voucher/Coupon code" (newsletterpop) before version 2.6.1 from Active Design for PrestaShop, a guest can perform SQL injection in affected versions. The method `NewsletterpopsendVerificationModuleFrontController::checkEmailSubscription()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.

EPSS

Процентиль: 30%
0.00109
Низкий

9.8 Critical

CVSS3

Дефекты

CWE-89