CVE-2023-33280 - In the Store Commander scquickaccounting module for PrestaShop through 3.7.3, multiple sensitive SQL calls can be executed with a trivial HTTP request and exploited to forge a blind SQL injection

Back Back to CVE browser

CRITICAL

In the Store Commander scquickaccounting module for PrestaShop through 3.7.3, multiple sensitive SQL calls can be executed with a trivial HTTP request and exploited to forge a blind SQL injection

Published May 25, 2023

9.8

CRITICAL

CVSS 3.1

EPSS 0.62%

Description

In the Store Commander scquickaccounting module for PrestaShop through 3.7.3, multiple sensitive SQL calls can be executed with a trivial HTTP request and exploited to forge a blind SQL injection.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-37445
Advisory
https://friends-of-presta.github.io/security-advisories/modules/2023/05/25/scquickaccounting.html
Third Party Advisory
https://www.storecommander.com/en/addons/440-order-export-pro.html
Vendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-37445		Advisory
https://friends-of-presta.github.io/security-advisories/modules/2023/05/25/scquickaccounting.html		Third Party Advisory
https://www.storecommander.com/en/addons/440-order-export-pro.html		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published May 25, 2023

Updated Jan 16, 2025

Reserved May 22, 2023

Link CVE-2023-33280

CISA Vulnrichment

Updated Jan 16, 2025

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2023-33280

Red Hat

No data

ENISA EUVD

Assigner mitre

Published May 25, 2023

Updated Jan 16, 2025

Link EUVD-2023-37445

GitHub

No data