PT-2023-24931 · Unknown · Prestashop

Published 2023-09-21 · Updated 2026-06-12 · CVE-2023-34576

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions PrestaShop opartfaq versions 1.0.3 and earlier

Description The issue allows remote attackers to run arbitrary SQL commands via an unspecified vector, potentially leading to unauthorized access or data manipulation. This is due to a SQL injection vulnerability in the updatepos.php file.

Recommendations For PrestaShop opartfaq versions 1.0.3 and earlier, consider disabling access to the updatepos.php file until a patch is available to prevent exploitation of the SQL injection vulnerability.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-34576

Affected Products

Prestashop

References · 9

• https://security.friendsofpresta.org/modules/2023/09/19/opartfaq.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-34576 · Security Note
• https://osv.dev/vulnerability/CVE-2023-34576 · Vendor Advisory
• https://t.me/cibsecurity/70926 · Telegram Post
• https://twitter.com/CVEnew/status/1704943137020358787 · Twitter Post
• https://t.me/cvenotify/58352 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1704988568202985882 · Twitter Post
• https://t.me/cveNotify/167206 · Telegram Post
• https://t.me/cvenotify/58493 · Telegram Post