In the module "Newsletter Popup PRO with Voucher/Coupon code" (newsletterpop) before version 2.6.1 from Active Design for PrestaShop, a guest can perform SQL injection in affected versions. The method `NewsletterpopsendVerificationModuleFrontController::checkEmailSubscription()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.
References
| Link | Resource |
|---|---|
| https://github.com/friends-of-presta/security-advisories/blob/main/_posts/2023-11-09-newsletterpop.md | Patch Third Party Advisory |
| https://github.com/friends-of-presta/security-advisories/blob/main/_posts/2023-11-09-newsletterpop.md | Patch Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 08:30
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/friends-of-presta/security-advisories/blob/main/_posts/2023-11-09-newsletterpop.md - Patch, Third Party Advisory |
21 Nov 2023, 20:14
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/friends-of-presta/security-advisories/blob/main/_posts/2023-11-09-newsletterpop.md - Patch, Third Party Advisory | |
| CWE | CWE-89 | |
| First Time |
Activedesign
Activedesign newsletterpop |
|
| CPE | cpe:2.3:a:activedesign:newsletterpop:*:*:*:*:*:prestashop:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
15 Nov 2023, 02:28
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-11-15 01:15
Updated : 2024-11-21 08:30
NVD link : CVE-2023-47308
Mitre link : CVE-2023-47308
CVE.ORG link : CVE-2023-47308
JSON object : View
Products Affected
activedesign
- newsletterpop
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')