PT-2023-22557 · Unknown+1 · Prestashop+1

CVE-2023-30149 · Publicado 2023-06-02 · Atualizado 2023-06-12

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PrestaShop module City Autocomplete versions prior to 1.8.12 (for PrestaShop version 1.5/1.6) PrestaShop module City Autocomplete versions prior to 2.0.3 (for PrestaShop version 1.7)

Description The issue allows remote attackers to execute arbitrary SQL commands via the type, input name, or q parameter in the "autocompletion.php" front controller. This can lead to unauthorized access and manipulation of database content.

Recommendations For PrestaShop module City Autocomplete versions prior to 1.8.12 (for PrestaShop version 1.5/1.6), update to version 1.8.12 or later. For PrestaShop module City Autocomplete versions prior to 2.0.3 (for PrestaShop version 1.7), update to version 2.0.3 or later. As a temporary workaround, consider restricting access to the autocompletion.php front controller until a patch is applied. Avoid using the type, input name, or q parameters in the affected API endpoint until the issue is resolved.

Exploit

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-30149

Produtos afetados

City Autocomplete

Prestashop

Referências · 5

• 🔥 https://friends-of-presta.github.io/security-advisories/module/2023/06/01/cityautocomplete.html · Exploit
• https://addons.prestashop.com/fr/inscription-processus-de-commande/6097-city-autocomplete.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-30149 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-30149 · Aviso do Fabricante
• https://t.me/cibsecurity/64888 · Publicação no Telegram