critical9.8
CVE-2023-43986
DM Concept configurator before v4.9.4 was discovered to contain a SQL injection vulnerability via the component ConfiguratorAttachment::getAttachmentByToken.
Impact
DM Concept configurator before v4.9.4 was discovered to contain a SQL injection vulnerability via the component ConfiguratorAttachment::getAttachmentByToken.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dmconcept | Configurator | before 4.9.4 |
Weakness classification
References
- NVD record
- CVE.org record
- https://addons.prestashop.com/fr/declinaisons-personnalisation/20343-configurateur-avance-de-produit-sur-mesure-par-etape.html
- https://security.friendsofpresta.org/modules/2023/10/19/configurator.html
- https://addons.prestashop.com/fr/declinaisons-personnalisation/20343-configurateur-avance-de-produit-sur-mesure-par-etape.html
- https://security.friendsofpresta.org/modules/2023/10/19/configurator.html