critical9.8
CVE-2023-45376
In the module "Carousels Pack - Instagram, Products, Brands, Supplier" (hicarouselspack) for PrestaShop up to version 1.5.0 from HiPresta for PrestaShop, a gue…
Impact
In the module "Carousels Pack - Instagram, Products, Brands, Supplier" (hicarouselspack) for PrestaShop up to version 1.5.0 from HiPresta for PrestaShop, a guest can perform SQL injection via HiCpProductGetter::getViewedProduct().`
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Hipresta | Carousels Pack | before 1.5.1 |
Weakness classification
References
- NVD record
- CVE.org record
- https://addons.prestashop.com/en/sliders-galleries/20410-carousels-pack-instagram-products-brands-supplier.html
- https://security.friendsofpresta.org/modules/2023/10/19/hicarouselspack.html
- https://addons.prestashop.com/en/sliders-galleries/20410-carousels-pack-instagram-products-brands-supplier.html
- https://security.friendsofpresta.org/modules/2023/10/19/hicarouselspack.html