PT-2023-21999 · Prestashop · Shoppingfeed Prestashop

CVE-2023-28839 · Publicado 2023-04-18 · Atualizado 2023-04-27

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Shoppingfeed PrestaShop versions 1.4.0 through 1.8.2

Description The Shoppingfeed PrestaShop module is vulnerable to SQL injection due to a lack of input sanitization. This issue has been addressed in version 1.8.3.

Recommendations For versions 1.4.0 through 1.8.2, upgrade to version 1.8.3 to resolve the issue. As a temporary workaround, consider restricting input to minimize the risk of SQL injection until a patch is applied.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-28839

GHSA-VFMQ-W777-QVCF

Produtos afetados

Shoppingfeed Prestashop

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28839.json · Exploit
• https://github.com/shoppingflux/module-prestashop/security/advisories/GHSA-vfmq-w777-qvcf · Aviso do Fabricante
• https://github.com/shoppingflux/module-prestashop/pull/209 · Correção
• https://t.me/cvenotify/49238 · Publicação no Telegram
• https://t.me/cvenotify/48528 · Publicação no Telegram
• https://t.me/cibsecurity/62411 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-28839 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-28839 · Aviso do Fabricante