An SQL injection vulnerability in the Payplug (payplug) module for PrestaShop, in versions 3.6.0, 3.6.1, 3.6.2, 3.6.3, 3.7.0 and 3.7.1, allows remote attackers to execute arbitrary SQL commands via the ajax.php front controller.
References
| Link | Resource |
|---|---|
| https://addons.prestashop.com/en/payment-card-wallet/8795--payplug-accept-customer-payments-wherever-they-are.html | Product |
| https://security.friendsofpresta.org/module/2023/07/18/payplug.html | Exploit Patch Third Party Advisory |
Configurations
History
27 Jul 2023, 03:55
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://security.friendsofpresta.org/module/2023/07/18/payplug.html - Exploit, Patch, Third Party Advisory | |
| References | (MISC) https://addons.prestashop.com/en/payment-card-wallet/8795--payplug-accept-customer-payments-wherever-they-are.html - Product | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| First Time |
Prestashop payplug
Prestashop |
|
| CWE | CWE-89 | |
| CPE | cpe:2.3:a:prestashop:payplug:*:*:*:*:*:prestashop:*:* |
18 Jul 2023, 19:49
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-07-18 19:15
Updated : 2023-12-10 15:14
NVD link : CVE-2023-30153
Mitre link : CVE-2023-30153
CVE.ORG link : CVE-2023-30153
JSON object : View
Products Affected
prestashop
- payplug
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')