CVE-2024-24303

CRITICAL

HiPresta Gift Wrapping Pro < 1.4.1 - SQL Injection via addGiftWrappingCartValue Method

Title source: llm
STIX 2.1

Description

SQL Injection vulnerability in HiPresta "Gift Wrapping Pro" (hiadvancedgiftwrapping) module for PrestaShop before version 1.4.1, allows remote attackers to escalate privileges and obtain sensitive information via the HiAdvancedGiftWrappingGiftWrappingModuleFrontController::addGiftWrappingCartValue() method.

References (1)

Core 1

Scores

CVSS v3 9.8
EPSS 0.0068
EPSS Percentile 47.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-89
Status published
Products (1)
hipresta/gift_wrapping_pro < 1.4.1
Published Feb 07, 2024
Tracked Since Feb 18, 2026