CVE-2023-36263 - Prestashop opartlimitquantity 1.4.5 and before is vulnerable to SQL Injection

Back Back to CVE browser

CRITICAL

Prestashop opartlimitquantity 1.4.5 and before is vulnerable to SQL Injection

Published Oct 31, 2023

9.8

CRITICAL

CVSS 3.1

EPSS 0.49%

Description

Prestashop opartlimitquantity 1.4.5 and before is vulnerable to SQL Injection. OpartlimitquantityAlertlimitModuleFrontController::displayAjaxPushAlertMessage()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-40234
Advisory
https://security.friendsofpresta.org/modules/2023/10/25/opartlimitquantity.html
PatchThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-40234		Advisory
https://security.friendsofpresta.org/modules/2023/10/25/opartlimitquantity.html		PatchThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Oct 31, 2023

Updated Sep 6, 2024

Reserved Jun 21, 2023

Link CVE-2023-36263

CISA Vulnrichment

Updated Sep 6, 2024

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2023-36263

Red Hat

No data

ENISA EUVD

Assigner mitre

Published Oct 31, 2023

Updated Sep 6, 2024

Link EUVD-2023-40234

GitHub

No data