CVE-2023-30154

Published: 2023-10-14T04:15Z

Last Modified: 2024-11-21T07:59Z

Source: MITRE CVE List

License: MITRE-CVE-TOS

Multiple improper neutralization of SQL parameters in module AfterMail (aftermailpresta) for PrestaShop, before version 2.2.1, allows remote attackers to perform SQL injection attacks via `id_customer`, `id_conf`, `id_product` and `token` parameters in `aftermailajax.php via the 'id_product' parameter in hooks DisplayRightColumnProduct and DisplayProductButtons. > MITRE Terms of Use apply – see LICENSE‑MITRE.txt