PT-2024-25184 · Shipup · Shipup

Published 2024-04-30 · Updated 2024-04-30 · CVE-2024-33273

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions shipup versions prior to 3.3.0

Description A SQL injection issue allows a remote attacker to escalate privileges via the getShopID function. This enables the attacker to potentially gain unauthorized access to sensitive data or systems.

Recommendations For versions prior to 3.3.0, update to version 3.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the getShopID function until a patch is available.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-33273

Affected Products

Shipup

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-33273 · Security Note
• https://security.friendsofpresta.org/modules/2024/04/29/shipup.html · Note
• https://twitter.com/CVEnew/status/1785329348247183701 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1785353218660168147 · Twitter Post
• https://shipup.co/fr · Note
• https://t.me/cvenotify/78603 · Telegram Post