CVE-2023-34575 - OpenCVE

SQL injection vulnerability in PrestaShop opartsavecart through 2.0.7 allows remote attackers to run arbitrary SQL commands via OpartSaveCartDefaultModuleFrontController::initContent() and OpartSaveCartDefaultModuleFrontController::displayAjaxSendCartByEmail() methods.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Vendors	Products
Op\'art Save Cart Project	Op\'art Save Cart

Configuration 1 [-]

cpe:2.3:a:op\'art_save_cart_project:op\'art_save_cart:*:*:*:*:*:prestashop:*:*

No data.

References

Link	Providers
https://security.friendsofpresta.org/modules/2023/09/19/opartsavecart.html

History

Tue, 24 Sep 2024 21:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-09-20T00:00:00

Updated: 2024-09-24T20:32:14.359Z

Reserved: 2023-06-07T00:00:00

Link: CVE-2023-34575

Vulnrichment

Updated: 2024-08-02T16:10:07.106Z

NVD

Status : Analyzed

Published: 2023-09-20T22:15:12.393

Modified: 2023-09-22T19:02:44.837

Link: CVE-2023-34575

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:op\\'art_save_cart_project:op\\'art_save_cart:*:*:*:*:*:prestashop:*:*", "matchCriteriaId": "8A4F34F7-61E6-4E14-9A4D-6F00C9A95AC9", "versionEndIncluding": "2.0.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SQL injection vulnerability in PrestaShop opartsavecart through 2.0.7 allows remote attackers to run arbitrary SQL commands via OpartSaveCartDefaultModuleFrontController::initContent() and OpartSaveCartDefaultModuleFrontController::displayAjaxSendCartByEmail() methods."}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n SQL en PrestaShop opartsavecart hasta 2.0.7 permite a atacantes remotos ejecutar comandos SQL de su elecci\u00f3n mediante los m\u00e9todos OpartSaveCartDefaultModuleFrontController::initContent() y OpartSaveCartDefaultModuleFrontController::displayAjaxSendCartByEmail()."}], "id": "CVE-2023-34575", "lastModified": "2023-09-22T19:02:44.837", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "cve@mitre.org", "type": "Secondary"}]}, "published": "2023-09-20T22:15:12.393", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://security.friendsofpresta.org/modules/2023/09/19/opartsavecart.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Primary"}]}