PT-2023-21214 · Prestashop · Eo Tags

Published 2023-03-21 · Updated 2025-02-26 · CVE-2023-27570

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions eo tags package versions prior to 1.4.19 for PrestaShop

Description The issue allows SQL injection via a crafted ga cookie. This enables potential attackers to inject malicious SQL code, potentially leading to unauthorized access or manipulation of data.

Recommendations For versions prior to 1.4.19, update to version 1.4.19 or later to resolve the issue. As a temporary workaround, consider restricting access to the ga cookie to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-27570

Affected Products

Eo Tags

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-27570 · Security Note
• https://security.profileo.com/cve/eo_tags_2023-27569-27570 · Patch
• https://osv.dev/vulnerability/CVE-2023-27570 · Vendor Advisory
• https://profileo.com · Note
• https://t.me/cvenotify/112524 · Telegram Post
• https://t.me/cibsecurity/60389 · Telegram Post