{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-39648", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-09-20T16:28:22.568Z", "dateReserved": "2023-08-07T00:00:00", "datePublished": "2023-10-03T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2023-10-03T21:49:25.112243"}, "descriptions": [{"lang": "en", "value": "Improper neutralization of SQL parameter in Theme Volty CMS Testimonial module for PrestaShop. In the module \u201cTheme Volty CMS Testimonial\u201d (tvcmstestimonial) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://security.friendsofpresta.org/modules/2023/09/26/tvcmstestimonial.html"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T18:18:09.245Z"}, "title": "CVE Program Container", "references": [{"url": "https://security.friendsofpresta.org/modules/2023/09/26/tvcmstestimonial.html", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-20T16:28:06.677262Z", "id": "CVE-2023-39648", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-20T16:28:22.568Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://security.friendsofpresta.org/modules/2023/09/26/tvcmstestimonial.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T18:18:09.245Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-39648", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-09-20T16:28:06.677262Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-20T16:28:16.750Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://security.friendsofpresta.org/modules/2023/09/26/tvcmstestimonial.html"}], "descriptions": [{"lang": "en", "value": "Improper neutralization of SQL parameter in Theme Volty CMS Testimonial module for PrestaShop. In the module \u201cTheme Volty CMS Testimonial\u201d (tvcmstestimonial) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2023-10-03T21:49:25.112243"}}}, "cveMetadata": {"cveId": "CVE-2023-39648", "state": "PUBLISHED", "dateUpdated": "2024-09-20T16:28:22.568Z", "dateReserved": "2023-08-07T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2023-10-03T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:themevolty:theme_volty_cms_testimonial:*:*:*:*:*:prestashop:*:*", "matchCriteriaId": "950F64C2-BD91-4F39-822B-2EB3759CCE66", "versionEndIncluding": "4.0.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper neutralization of SQL parameter in Theme Volty CMS Testimonial module for PrestaShop. In the module \u201cTheme Volty CMS Testimonial\u201d (tvcmstestimonial) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions."}, {"lang": "es", "value": "Neutralizaci\u00f3n incorrecta del par\u00e1metro SQL en el m\u00f3dulo Theme Volty CMS Testimonial para PrestaShop. En el m\u00f3dulo \u201cTestimonio de Theme Volty CMS\u201d (tvcmstestimonial) hasta la versi\u00f3n 4.0.1 de Theme Volty para PrestaShop, un invitado puede realizar inyecci\u00f3n SQL en las versiones afectadas."}], "id": "CVE-2023-39648", "lastModified": "2023-10-05T15:17:30.923", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-10-03T22:15:10.323", "references": [{"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://security.friendsofpresta.org/modules/2023/09/26/tvcmstestimonial.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}