SQL Injection Vulnerability in Mib Module for PrestaShop by MyPresta.eu
CVE-2023-46351

9.8CRITICAL

Key Information:

Vendor

Mypresta

Status
Manufacturers \(brands\) Images Block
Vendor
CVE Published:
19 January 2024

What is CVE-2023-46351?

The Mib module from MyPresta.eu for PrestaShop has been identified to contain a SQL injection vulnerability that can be exploited by an unauthenticated guest. The method mib::getManufacturersByCategory() includes sensitive SQL operations that can be manipulated through simple HTTP requests. This flaw allows attackers to execute arbitrary SQL queries, potentially compromising the database and extracting sensitive information. It is crucial for users of this module to apply the necessary security measures to safeguard their applications.

References

https://mypresta.eu/modules/front-office-features/manufac...
https://security.friendsofpresta.org/modules/2024/01/18/m...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.