IMPORTANT NOTICE: DO NOT REPORT VULNERABILITIES SOLELY TO THE AUTHOR OR MARKETPLACE.
We urge you to report any vulnerabilities directly to us. Our mission is to ensure the safety and security of the PrestaShop ecosystem. Unfortunately, many module developers may not always recognize or acknowledge the vulnerabilities in their code, whether due to lack of awareness, or inability to properly evaluate the associated risk, or other reasons.
Given the rise in professional cybercrime networks actively seeking out these vulnerabilities, it's crucial that any potential threats are promptly addressed and the community is informed. The most effective method to do this is by publishing a CVE, like the one provided below.
Should you discover any vulnerabilities, please report them to us at: report[@]security-presta.org or visit https://security-presta.org for more information.
Every vulnerability report helps make the community more secure, and we are profoundly grateful for any information shared with us.
-
[CVE-2023-31672] Improper neutralization of an SQL parameter in ailinear module for PrestaShop
In the module “Length, weight or volume sell” (ailinear) for PrestaShop, an attacker can perform SQL injection up to 2.4.3. Release 2.4.3 fixed this security issue.
-
[CVE-2023-31671] Improper neutralization of SQL parameter in Postfinance module
SQL injection vulnerability found in the module “Postfinance” edited by Webbax for PrestaShop before 17.1.14. (17.1.14 fix the issue) allow a remote attacker to perform SQL injection in affected versions.
-
[CVE-2023-30198] Improper Limitation of a Pathname to a Restricted Directory in Webbax - Winbiz Payment module for PrestaShop
In the module “Winbiz Payment” (winbizpayment) from Webbax for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack.
-
[CVE-2023-30150] Improper neutralization of SQL parameters in the Leo Custom Ajax (leocustomajax) module from LeoTheme for PrestaShop
Multiple SQL injection vulnerabilities in the Leo Custom Ajax (leocustomajax) module from LeoTheme for PrestaShop, in version 1.0, allow remote attackers to execute arbitrary SQL commands via the
cat_list,pro_info,pro_add,pro_cdownorpro_colorparameter inleoajax.php. -
[CVE-2023-3031] Improper Limitation of a Pathname to a Restricted Directory in Webbax - King-Avis module for PrestaShop
Improper Limitation of a Pathname leads to a Path Traversal vulnerability in the module King-Avis for Prestashop, allowing a user knowing the download token to read arbitrary local files.This issue affects King-Avis: before 17.3.15.
-
[CVE-2023-30149] Improper neutralization of SQL parameter in the City Autocomplete (cityautocomplete) module from ebewe.net for PrestaShop
SQL injection vulnerability in the City Autocomplete (cityautocomplete) module from ebewe.net for PrestaShop, prior to version 1.8.12 (for PrestaShop version 1.5/1.6) or prior to 2.0.3 (for PrestaShop version 1.7), allows remote attackers to execute arbitrary SQL commands via the
type,input_name. orqparameter in theautocompletion.phpfront controller. -
[CVE-2023-30197] Improper Limitation of a Pathname to a Restricted Directory in Webbax - My inventory module for PrestaShop
In the module “My inventory” (myinventory) from Webbax for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack.
-
[CVE-2023-33280] Improper neutralization of multiple SQL parameters in the scquickaccounting module for PrestaShop
In the module “SC Quick Accounting” (scquickaccounting), an anonymous user can perform a SQL injection. The module have been patched in version 3.7.4.
-
[CVE-2023-33279] Improper neutralization of multiple SQL parameters in the SC Fix My PrestaShop module for PrestaShop
In the module “SC Fix My PrestaShop” (scfixmyprestashop), an anonymous user can perform a SQL injection. The module is obsolete and must be deleted.
-
[CVE-2023-33278] Improper neutralization of multiple SQL parameters in the scexportcustomers module for PrestaShop
In the module “SC Export Customers” (scexportcustomers), an anonymous user can perform SQL injections. The module have been patched in version 3.6.2.