Paper/Archive/CVE-2024-25847

CVE-2024-25847

myprestamodules product_catalog_import_for_prestashop — SQL Injection vulnerability in MyPrestaModules "Product Catalog (CSV, Excel) Import" (simpleimportproduct) modules for PrestaShop version…

EPSS 0.5%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 45.0.450 × 209.0 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

SQL Injection vulnerability in MyPrestaModules "Product Catalog (CSV, Excel) Import" (simpleimportproduct) modules for PrestaShop versions 6.5.0 and before, allows attackers to escalate privileges and obtain sensitive information via Send::__construct() and importProducts::_addDataToDb methods.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

product_catalog_import_for_prestashop< 6.5.06.5.0CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/friends-of-presta/security-advisories/blob/main/_posts/2024-02-29-simpleimportproduct.md