PT-2023-21999 · Prestashop · Shoppingfeed Prestashop

Published 2023-04-18 · Updated 2023-04-27 · CVE-2023-28839

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Shoppingfeed PrestaShop versions 1.4.0 through 1.8.2

Description The Shoppingfeed PrestaShop module is vulnerable to SQL injection due to a lack of input sanitization. This issue has been addressed in version 1.8.3.

Recommendations For versions 1.4.0 through 1.8.2, upgrade to version 1.8.3 to resolve the issue. As a temporary workaround, consider restricting input to minimize the risk of SQL injection until a patch is applied.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-28839

GHSA-VFMQ-W777-QVCF

Affected Products

Shoppingfeed Prestashop

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28839.json · Exploit
• https://github.com/shoppingflux/module-prestashop/security/advisories/GHSA-vfmq-w777-qvcf · Vendor Advisory
• https://github.com/shoppingflux/module-prestashop/pull/209 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-28839 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28839 · Vendor Advisory
• https://t.me/cvenotify/49238 · Telegram Post
• https://t.me/cvenotify/48528 · Telegram Post
• https://t.me/cibsecurity/62411 · Telegram Post