CVE-2023-45375

HIGHNuclei

PrestaShop PireosPay - SQL Injection

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2023-45375 has a selected CVSS score of 8.8 (high); EIP currently links 1 Nuclei template.

Description

In the module "PireosPay" (pireospay) before version 1.7.10 from 01generator.com for PrestaShop, a guest can perform SQL injection via `PireosPayValidationModuleFrontController::postProcess().`

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 16, 2024 · Source: CVE List

Nuclei templates

1
ProjectDiscoveryHIGHPrestaShop PireosPay - SQL InjectionCVSS 8.8

In the module “PireosPay” (pireospay) up to version 1.7.9 from 01generator.com for PrestaShop, a guest can perform SQL injection in affected versions.

Impact

Authenticated attackers can execute time-based SQL injection through the MerchantReference parameter in the validation endpoint to extract PrestaShop database information including customer and payment data.

Remediation

Update PireosPay module to a version newer than 1.7.9 that properly sanitizes SQL parameters in the validation endpoint.

WeaknessesCWE-89
AuthorsMaStErChO
Template tagstime-based-sqlicvecve2023sqliprestashoppireospay01generatorvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:01generator:pireospay:*:*:*:*:*:prestashop:*:*
Shodan: http.component:"prestashop"
https://security.friendsofpresta.org/modules/2023/10/12/pireospay.html https://github.com/fkie-cad/nvd-json-data-feeds

Source: ProjectDiscovery

References

2