PT-2023-22001 · Prestashop · Prestashop/Paypal+1

Touchweb-Vincent · Published 2023-03-31 · Updated 2023-04-07 · CVE-2023-28843

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PrestaShop/paypal versions 3.12.0 through 3.16.3

Description A SQL injection issue allows a remote attacker to gain privileges, modify data, and potentially affect system availability. The cause of this issue is that SQL queries were being constructed with user input which had not been properly filtered. Only deployments on PrestaShop 1.6 are affected.

Recommendations For PrestaShop/paypal versions 3.12.0 through 3.16.3, upgrade to module version 3.16.4. As a temporary workaround, consider restricting user input to prevent SQL injection attacks until a patch is available.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-28843

GHSA-66PC-8GH8-MX7M

Affected Products

Prestashop

Prestashop/Paypal

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28843.json · Exploit
• 🔥 https://github.com/202ecommerce/paypal/security/advisories/GHSA-66pc-8gh8-mx7m · Exploit
• https://github.com/202ecommerce/paypal/commit/2f6884ea1d0fe4b58441699fcc1d6c56c7d733eb · Patch
• https://osv.dev/vulnerability/CVE-2023-28843 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28843 · Security Note
• https://t.me/cvenotify/47775 · Telegram Post
• https://t.me/cibsecurity/61271 · Telegram Post