PT-2023-24931 · Unknown · Prestashop

Publicado 2023-09-21 · Atualizado 2026-06-12 · CVE-2023-34576

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions PrestaShop opartfaq versions 1.0.3 and earlier

Description The issue allows remote attackers to run arbitrary SQL commands via an unspecified vector, potentially leading to unauthorized access or data manipulation. This is due to a SQL injection vulnerability in the updatepos.php file.

Recommendations For PrestaShop opartfaq versions 1.0.3 and earlier, consider disabling access to the updatepos.php file until a patch is available to prevent exploitation of the SQL injection vulnerability.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-34576

Produtos afetados

Prestashop

Referências · 9

• https://security.friendsofpresta.org/modules/2023/09/19/opartfaq.html · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-34576 · Nota de Segurança
• https://t.me/cibsecurity/70926 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1704943137020358787 · Publicação no Twitter
• https://t.me/cvenotify/58352 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1704988568202985882 · Publicação no Twitter
• https://t.me/cveNotify/167206 · Publicação no Telegram
• https://t.me/cvenotify/58493 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-34576 · Aviso do Fabricante