IMPORTANT NOTICE: DO NOT REPORT VULNERABILITIES SOLELY TO THE AUTHOR OR MARKETPLACE.
We urge you to report any vulnerabilities directly to us. Our mission is to ensure the safety and security of the PrestaShop ecosystem. Unfortunately, many module developers may not always recognize or acknowledge the vulnerabilities in their code, whether due to lack of awareness, or inability to properly evaluate the associated risk, or other reasons.
Given the rise in professional cybercrime networks actively seeking out these vulnerabilities, it's crucial that any potential threats are promptly addressed and the community is informed. The most effective method to do this is by publishing a CVE, like the one provided below.
Should you discover any vulnerabilities, please report them to us at: report[@]security-presta.org or visit https://security-presta.org for more information.
Every vulnerability report helps make the community more secure, and we are profoundly grateful for any information shared with us.
-
[CVE-2023-30196] Improper Limitation of a Pathname to a Restricted Directory in Webbax - Sales Booster module for PrestaShop
In the module “Sales Booster” (salesbooster) from Webbax for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack.
-
[CVE-2023-30191] Improper neutralization of SQL parameter in Prestaeg - CDesigner module for PrestaShop
In the module “CDesigner” (cdesigner) from Prestaeg for PrestaShop, a guest can perform SQL injection in affected versions.
-
[CVE-2023-30199] Improper Limitation of a Pathname to a Restricted Directory in Webbax - Custom Exporter module for PrestaShop
In the module “Custom Exporter” (customexporter) from Webbax for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack.
-
[CVE-2023-30192] Improper neutralization of SQL parameter in PosThemes - Search Products for PrestaShop
In the module “Search Products” (possearchproducts) from PosThemes for PrestaShop, a guest can perform SQL injection in affected versions.
-
[CVE-2023-30194] Improper neutralization of SQL parameter in Posthemes - Static Footer module for PrestaShop
In the module “Static Footer” (posstaticfooter) from PosThemes for PrestaShop, a guest can perform SQL injection in affected versions.
-
[CVE-2023-30281] Exposure of Private Personal Information to an Unauthorized Actor in SC Quick Accounting module for PrestaShop
In the module “SC Quick Accounting” (scquickaccounting), a guest can download personal information without restriction.
-
[CVE-2023-30839] SQL filter bypass leading to arbitrary write requests using SQL Manager [DEBATE RUNNING ABOUT SCORING FROM PS CORE]
SQL filtering vulnerability, a BO user can write, update and delete in the database, even without having specific rights.
-
[CVE-2023-30838] Possible XSS injection through Validate::isCleanHTML method
ValidateCore::isCleanHTML() method of Prestashop misses hijickable events which can lead to XSS injection, allowed by the presence of pre-setup @Keyframes methods.
-
[CVE-2023-30545] Arbitrary file read via the backoffice Database Manager [DEBATE RUNNING ABOUT SCORING FROM PS CORE]
As an admin manager logged, the Database Manager interface let create LOAD_FILE select request.
-
[CVE-2023-30282] Exposure of Private Personal Information to an Unauthorized Actor in SC Export Customers module for PrestaShop
In the module “SC Export Customers” (scexportcustomers), a guest can download personal information without restriction.