CVE-2024-25847

CRITICAL

Myprestamodules Product Catalog (csv,... - Improper Privilege Management

Title source: rule
STIX 2.1

Description

SQL Injection vulnerability in MyPrestaModules "Product Catalog (CSV, Excel) Import" (simpleimportproduct) modules for PrestaShop versions 6.5.0 and before, allows attackers to escalate privileges and obtain sensitive information via Send::__construct() and importProducts::_addDataToDb methods.

References (1)

Core 1

Scores

CVSS v3 9.8
EPSS 0.0005
EPSS Percentile 16.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-269
Status published
Products (1)
myprestamodules/product_catalog_\(csv\,_excel\)_import < 6.5.0
Published Mar 03, 2024
Tracked Since Feb 18, 2026