CVE-2023-33280
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
The scquickaccounting module in Store Commander for PrestaShop up to version 3.7.3 allows multiple sensitive SQL calls to be executed with a trivial HTTP request, potentially leading to a blind SQL injection vulnerability.
Risk Assessment
The organization may be exposed to unauthorized data access and database manipulation, which could lead to serious legal and financial consequences.
Recommendation
It is recommended to update the scquickaccounting module to the latest version and conduct a security audit of the application to minimize risk.
Original NVD description (English source)
In the Store Commander scquickaccounting module for PrestaShop through 3.7.3, multiple sensitive SQL calls can be executed with a trivial HTTP request and exploited to forge a blind SQL injection.