PT-2023-22562 · Aftermail+1 · Aftermail+1

Published 2023-10-13 · Updated 2023-10-18 · CVE-2023-30154

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AfterMail (aftermailpresta) for PrestaShop versions prior to 2.2.1

Description The issue is related to multiple improper neutralization of SQL parameters, allowing remote attackers to perform SQL injection attacks. This can be done via parameters such as id customer, id conf, id product, and token in aftermailajax.php, as well as via the id product parameter in hooks DisplayRightColumnProduct and DisplayProductButtons.

Recommendations For versions prior to 2.2.1, update to version 2.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the aftermailajax.php file and limiting the use of the id customer, id conf, id product, and token parameters until a patch is applied. Restrict access to the hooks DisplayRightColumnProduct and DisplayProductButtons to minimize the risk of exploitation via the id product parameter.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-30154

Affected Products

Aftermail

Prestashop

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-30154 · Security Note
• https://osv.dev/vulnerability/CVE-2023-30154 · Vendor Advisory
• https://security.friendsofpresta.org/modules/2023/10/10/aftermailpresta.html · Patch
• https://twitter.com/zeeshankghouri/status/1713068567758090278 · Twitter Post
• https://t.me/cibsecurity/72278 · Telegram Post