CVE-2023-33278
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
The scexportcustomers module in Store Commander for PrestaShop up to version 3.6.1 allows sensitive SQL calls to be executed with a trivial HTTP request, potentially leading to a blind SQL injection vulnerability.
Risk Assessment
Exploitation of this vulnerability could lead to unauthorized access to database data, posing a serious security threat to the organization.
Recommendation
It is recommended to update the Store Commander module to the latest version and implement appropriate security measures to minimize the risk of SQL injection attacks.
Original NVD description (English source)
In the Store Commander scexportcustomers module for PrestaShop through 3.6.1, sensitive SQL calls can be executed with a trivial HTTP request and exploited to forge a blind SQL injection.