PT-2024-1068 · Unknown+1 · Prestashop+1

Piotr Zdunek · Published 2024-01-08 · Updated 2024-01-12 · CVE-2023-6921

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PrestaShop (affected versions not specified) PrestaShow Google Integrator (PrestaShop addon) (affected versions not specified)

Description The issue is related to a Blind SQL Injection vulnerability in the PrestaShow Google Integrator addon for PrestaShop. This vulnerability allows an attacker to extract and modify data by inserting commands into one of the cookies. The vulnerability can be exploited remotely.

Recommendations For PrestaShop, consider restricting access to the PrestaShow Google Integrator addon until a patch is available. For PrestaShow Google Integrator (PrestaShop addon), avoid using the vulnerable cookie parameter until the issue is resolved. As a temporary workaround, consider disabling the PrestaShow Google Integrator addon until a patch is available.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2024-00304

CVE-2023-6921

Affected Products

Prestashop

Prestashow Google Integrator

References · 10

• https://bdu.fstec.ru/vul/2024-00304 · Security Note
• https://osv.dev/vulnerability/CVE-2023-6921 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6921 · Security Note
• https://t.me/cvenotify/67125 · Telegram Post
• https://cert.pl/posts/2024/01/CVE-2023-6921 · Note
• https://t.me/cvenotify/66610 · Telegram Post
• https://t.me/cvenotify/66581 · Telegram Post
• https://prestashow.pl/pl/moduly-prestashop/28-prestashop-google-integrator-ga4-gtm-ads-remarketing.html · Note
• https://cert.pl/en/posts/2024/01/CVE-2023-6921 · Note
• https://twitter.com/cracbot/status/1745899718281171302 · Twitter Post