Lucene search

MitreCVE-2023-46358

HistoryOct 25, 2023 - 6:17 p.m.

CVE-2023-46358

2023-10-2518:17:37

CWE-89

mitre

web.nvd.nist.gov

cve-2023-46358

sql injection

referral and affiliation program

module

snegurka

prestashop

nvd

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.001

Percentile

38.6%

JSON

In the module “Referral and Affiliation Program” (referralbyphone) version 3.5.1 and before from Snegurka for PrestaShop, a guest can perform SQL injection. Method ReferralByPhoneDefaultModuleFrontController::ajaxProcessCartRuleValidate has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.

Affected configurations

Nvd

Node

snegurkareferralbyphoneRange≤3.5.1prestashop

VendorProductVersionCPE
snegurkareferralbyphone*cpe:2.3:a:snegurka:referralbyphone:*:*:*:*:*:prestashop:*:*

Vendor	Product	Version	CPE
snegurka	referralbyphone	*	cpe:2.3:a:snegurka:referralbyphone::::::prestashop::*

References

security.friendsofpresta.org/modules/2023/10/24/referralbyphone.html

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.001

Percentile

38.6%

JSON

Related for CVE-2023-46358