CVE-2023-30149
critical · 9.8SQL injection vulnerability in the City Autocomplete (cityautocomplete) module from ebewe.net for PrestaShop, prior to version 1.8.12 (for PrestaShop version 1.5/1.6) or prior to 2.0.3 (for PrestaShop version 1.7), allows remote attackers to execute arbitrary SQL commands via the type, input_name. or q parameter in the autocompletion.php front controller.
9.8
CVSS
16.9%
EPSS (exploit prob.)
97th
EPSS percentile
2023-06-02
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| ebewe | city_autocomplete | < 1.8.12 |
| prestashop | prestashop | 1.5.0.0 |
| prestashop | prestashop | 1.6.0.0 |
| ebewe | city_autocomplete | < 2.0.3 |
| prestashop | prestashop | 1.7.0.0 |
Check a specific version with /api/v1/cve/match.
References
- https://addons.prestashop.com/fr/inscription-processus-de-commande/6097-city-autocomplete.html
- https://friends-of-presta.github.io/security-advisories/module/2023/06/01/cityautocomplete.html
- https://addons.prestashop.com/fr/inscription-processus-de-commande/6097-city-autocomplete.html
- https://friends-of-presta.github.io/security-advisories/module/2023/06/01/cityautocomplete.html
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2023-30149