SQL Injection Vulnerability in PrestaShop Module by PrestaShop
CVE-2024-28392

9.8CRITICAL

Key Information:

Vendor

PrestaShop

Status
PSCartAbandonmentPro
Vendor
CVE Published:
20 March 2024

What is CVE-2024-28392?

The PSCartAbandonmentPro module for PrestaShop contains a SQL injection vulnerability in versions up to 2.0.11. An attacker can exploit this flaw through the pscartabandonmentproFrontCAPUnsubscribeJobModuleFrontController::setEmailVisualized() method, which could allow unauthorized access and potential privilege escalation. It is crucial for users to apply the latest updates or patches provided by PrestaShop to mitigate this security risk.

References

https://addons.prestashop.com/en/remarketing-shopping-car...
https://security.friendsofpresta.org/modules/2024/03/14/p...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.