CVE-2023-36263
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Prestashop version opartlimitquantity 1.4.5 and earlier is vulnerable to SQL Injection. The method `OpartlimitquantityAlertlimitModuleFrontController::displayAjaxPushAlertMessage()` contains sensitive SQL calls that can be executed with a trivial HTTP call.
Risk Assessment
An attacker could exploit this vulnerability to execute unauthorized SQL queries, potentially leading to data exposure or database compromise.
Recommendation
It is recommended to update the opartlimitquantity module to the latest version to mitigate this vulnerability and review and secure sensitive SQL queries.
Original NVD description (English source)
Prestashop opartlimitquantity 1.4.5 and before is vulnerable to SQL Injection. OpartlimitquantityAlertlimitModuleFrontController::displayAjaxPushAlertMessage()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.