by Kastro
Paper/Archive/CVE-2023-6921

CVE-2023-6921

PrestaShow PrestaShop Google Integrator — SQL Injection in PrestaShop Google Integrator

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 53.0.530 × 2010.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Blind SQL Injection vulnerability in PrestaShow Google Integrator (PrestaShop addon) allows for data extraction and modification. This attack is possible via command insertion in one of the cookies.

Affected

ProductAffectedFixed inSource
PrestaShop Google Integrator< 2.1.42.1.4CNA

Scores by source

CERT-PL (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refprestashow.pl/pl/moduly-prestashop/28-prestashop-google-integrator-ga4-gtm-ads-remarketing.htmlrefcert.pl/en/posts/2024/01/CVE-2023-6921refcert.pl/posts/2024/01/CVE-2023-6921