CVE-2024-25847

CRITICAL

MyPrestaModules Product Catalog Import < 6.5.0 - SQL Injection & Privilege Escalation

Title source: llm
STIX 2.1

Description

SQL Injection vulnerability in MyPrestaModules "Product Catalog (CSV, Excel) Import" (simpleimportproduct) modules for PrestaShop versions 6.5.0 and before, allows attackers to escalate privileges and obtain sensitive information via Send::__construct() and importProducts::_addDataToDb methods.

References (1)

Core 1

Scores

CVSS v3 9.8
EPSS 0.0053
EPSS Percentile 40.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-269
Status published
Products (1)
myprestamodules/product_catalog_\(csv\,_excel\)_import < 6.5.0
Published Mar 03, 2024
Tracked Since Feb 18, 2026