PT-2023-22001 · Prestashop · Prestashop/Paypal+1

Touchweb-Vincent · Publicado 2023-03-31 · Atualizado 2023-04-07 · CVE-2023-28843

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PrestaShop/paypal versions 3.12.0 through 3.16.3

Description A SQL injection issue allows a remote attacker to gain privileges, modify data, and potentially affect system availability. The cause of this issue is that SQL queries were being constructed with user input which had not been properly filtered. Only deployments on PrestaShop 1.6 are affected.

Recommendations For PrestaShop/paypal versions 3.12.0 through 3.16.3, upgrade to module version 3.16.4. As a temporary workaround, consider restricting user input to prevent SQL injection attacks until a patch is available.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-28843

GHSA-66PC-8GH8-MX7M

Produtos afetados

Prestashop

Prestashop/Paypal

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28843.json · Exploit
• 🔥 https://github.com/202ecommerce/paypal/security/advisories/GHSA-66pc-8gh8-mx7m · Exploit
• https://github.com/202ecommerce/paypal/commit/2f6884ea1d0fe4b58441699fcc1d6c56c7d733eb · Correção
• https://t.me/cvenotify/47775 · Publicação no Telegram
• https://t.me/cibsecurity/61271 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-28843 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-28843 · Nota de Segurança