PT-2023-22560 · Prestashop · Prestashop Boxtal

CVE-2023-30151 · Publicado 2023-07-13 · Atualizado 2024-03-06

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PrestaShop Boxtal (envoimoinscher) module versions after 3.1.10

Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands via the key GET parameter. This affects the Boxtal module for PrestaShop.

Recommendations For PrestaShop Boxtal (envoimoinscher) module versions after 3.1.10, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting access to the key GET parameter to minimize the risk of exploitation.

Exploit

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

BIT-PRESTASHOP-2023-30151

CVE-2023-30151

Produtos afetados

Prestashop Boxtal

Referências · 9

• 🔥 https://security.friendsofpresta.org/module/2023/06/20/envoimoinscher.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-30151 · Nota de Segurança
• https://t.me/cvenotify/54866 · Publicação no Telegram
• https://t.me/cvenotify/54281 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-30151 · Aviso do Fabricante
• https://t.me/cvenotify/55634 · Publicação no Telegram
• https://help.boxtal.com/hc/fr/articles/360001342977-J-ai-besoin-du-module-PrestaShop-ancienne-version-Boxtal-Envoimoinscher-pour-mon-site · Nota
• https://addons.prestashop.com/en/shipping-carriers/1755-boxtal-connect-turnkey-shipping-solution.html · Nota
• https://osv.dev/vulnerability/BIT-prestashop-2023-30151 · Aviso do Fabricante