CVE-2014-2009
mpay24 < 1.5.1 - Unauthenticated Sensitive Information Exposure via Direct Request to API Log
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2014-2009. PoCs published by Wireghoul.
AI-analyzed exploit summary The document describes two vulnerabilities in the Mpay24 PrestaShop Payment Module: a blind SQL injection (CVE-2014-2008) and an information disclosure issue (CVE-2014-2009). The SQL injection allows database extraction via crafted requests, while the information disclosure exposes API credentials and local paths through an accessible log file.
Description
The mPAY24 payment module before 1.6 for PrestaShop allows remote attackers to obtain credentials, the installation path, and other sensitive information via a direct request to api/curllog.log.
Exploits (1)
The document describes two vulnerabilities in the Mpay24 PrestaShop Payment Module: a blind SQL injection (CVE-2014-2008) and an information disclosure issue (CVE-2014-2009). The SQL injection allows database extraction via crafted requests, while the information disclosure exposes API credentials and local paths through an accessible log file.