Lucene search

MitreCVE-2023-45386

HistoryOct 17, 2023 - 5:15 a.m.

CVE-2023-45386

2023-10-1705:15:50

CWE-89

mitre

web.nvd.nist.gov

cve

45386

sql injection

extratabspro

prestashop

mypresta.eu

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.8

Confidence

High

EPSS

0.001

Percentile

37.2%

JSON

In the module extratabspro before version 2.2.8 from MyPresta.eu for PrestaShop, a guest can perform SQL injection via extratabspro::searchcategory(), extratabspro::searchproduct() and `extratabspro::searchmanufacturer().’

Affected configurations

Nvd

Node

myprestaproduct_extra_tabs_proRange<2.2.8prestashop

VendorProductVersionCPE
myprestaproduct_extra_tabs_pro*cpe:2.3:a:mypresta:product_extra_tabs_pro:*:*:*:*:*:prestashop:*:*

Vendor	Product	Version	CPE
mypresta	product_extra_tabs_pro	*	cpe:2.3:a:mypresta:product_extra_tabs_pro::::::prestashop::*

References

security.friendsofpresta.org/modules/2023/10/12/extratabspro.html

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.8

Confidence

High

EPSS

0.001

Percentile

37.2%

JSON

Related for CVE-2023-45386