CVE-2023-46351

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-46351
In the module mib < 1.6.1 from MyPresta.eu for PrestaShop, a guest can perform SQL injection. The methods `mib::getManufacturersByCategory()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://mypresta.eu/modules/front-office-features/manufacturers-brands-images-block.html Product
https://security.friendsofpresta.org/modules/2024/01/18/mib.html Patch Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:mypresta:manufacturers_\(brands\)_images_block:*:*:*:*:*:prestashop:*:*
History

25 Jan 2024, 20:14

Type Values Removed Values Added
Summary
  • (es) En el módulo mib &lt; 1.6.1 de MyPresta.eu para PrestaShop, un invitado puede realizar una inyección SQL. Los métodos `mib::getManufacturersByCategory()` tienen llamadas SQL sensibles que pueden ejecutarse con una llamada http trivial y explotarse para falsificar una inyección SQL.
References () https://mypresta.eu/modules/front-office-features/manufacturers-brands-images-block.html - () https://mypresta.eu/modules/front-office-features/manufacturers-brands-images-block.html - Product
References () https://security.friendsofpresta.org/modules/2024/01/18/mib.html - () https://security.friendsofpresta.org/modules/2024/01/18/mib.html - Patch, Third Party Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
CPE cpe:2.3:a:mypresta:manufacturers_\(brands\)_images_block:*:*:*:*:*:prestashop:*:*
First Time Mypresta
Mypresta manufacturers \(brands\) Images Block
CWE CWE-89

19 Jan 2024, 15:56

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-19 14:15

Updated : 2024-01-25 20:14

NVD link : CVE-2023-46351

Mitre link : CVE-2023-46351

CVE.ORG link : CVE-2023-46351

JSON object : View

Products Affected

mypresta

  • manufacturers_\(brands\)_images_block
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')