PT-2024-27127 · Prestashop · Products Alert

Published 2024-06-24 · Updated 2024-11-14 · CVE-2024-36683

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions PrestaShop module "Products Alert" (productsalert) versions prior to 1.7.4

Description The issue allows attackers to obtain sensitive information and cause other impacts via the ProductsAlertAjaxProcessModuleFrontController::initContent method. This method is vulnerable to SQL injection attacks.

Recommendations For PrestaShop module "Products Alert" (productsalert) versions prior to 1.7.4, update to version 1.7.4 or later to resolve the issue. As a temporary workaround, consider disabling the ProductsAlertAjaxProcessModuleFrontController::initContent method until a patch is available.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-36683

Affected Products

Products Alert

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2024-36683 · Security Note
• https://security.friendsofpresta.org/modules/2024/06/20/productsalert.html · Note
• https://t.me/cvenotify/101721 · Telegram Post