PT-2023-27703 · Unknown · Myprestamodules Ordersexport

Published 2023-11-15 · Updated 2026-02-24 · CVE-2023-40923

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MyPrestaModules ordersexport versions prior to 5.0

Description The issue concerns multiple SQL injection vulnerabilities. These vulnerabilities are located at the send.php endpoint via the key and save setting parameters.

Recommendations For versions prior to 5.0, update to version 5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the send.php endpoint to minimize the risk of exploitation. Avoid using the key and save setting parameters in the affected endpoint until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-40923

Affected Products

Myprestamodules Ordersexport

References · 5

• https://osv.dev/vulnerability/CVE-2023-40923 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40923 · Security Note
• https://security.friendsofpresta.org/modules/2023/11/09/ordersexport.html · Patch
• https://t.me/cvenotify/60886 · Telegram Post
• https://t.me/cveNotify/153045 · Telegram Post