CVE-2023-6921

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-6921
Blind SQL Injection vulnerability in PrestaShow Google Integrator (PrestaShop addon) allows for data extraction and modification. This attack is possible via command insertion in one of the cookies.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://cert.pl/en/posts/2024/01/CVE-2023-6921/ Third Party Advisory
https://cert.pl/posts/2024/01/CVE-2023-6921/ Third Party Advisory
https://prestashow.pl/pl/moduly-prestashop/28-prestashop-google-integrator-ga4-gtm-ads-remarketing.html Product
https://cert.pl/en/posts/2024/01/CVE-2023-6921/ Third Party Advisory
https://cert.pl/posts/2024/01/CVE-2023-6921/ Third Party Advisory
https://prestashow.pl/pl/moduly-prestashop/28-prestashop-google-integrator-ga4-gtm-ads-remarketing.html Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:prestashow:google_integrator:*:*:*:*:*:prestashop:*:*
History

21 Nov 2024, 08:44

Type Values Removed Values Added
References () https://cert.pl/en/posts/2024/01/CVE-2023-6921/ - Third Party Advisory () https://cert.pl/en/posts/2024/01/CVE-2023-6921/ - Third Party Advisory
References () https://cert.pl/posts/2024/01/CVE-2023-6921/ - Third Party Advisory () https://cert.pl/posts/2024/01/CVE-2023-6921/ - Third Party Advisory
References () https://prestashow.pl/pl/moduly-prestashop/28-prestashop-google-integrator-ga4-gtm-ads-remarketing.html - Product () https://prestashow.pl/pl/moduly-prestashop/28-prestashop-google-integrator-ga4-gtm-ads-remarketing.html - Product
CVSS v2 : unknown
v3 : 9.1 		v2 : unknown
v3 : 9.8

11 Jan 2024, 20:57

Type Values Removed Values Added
References () https://cert.pl/en/posts/2024/01/CVE-2023-6921/ - () https://cert.pl/en/posts/2024/01/CVE-2023-6921/ - Third Party Advisory
References () https://cert.pl/posts/2024/01/CVE-2023-6921/ - () https://cert.pl/posts/2024/01/CVE-2023-6921/ - Third Party Advisory
References () https://prestashow.pl/pl/moduly-prestashop/28-prestashop-google-integrator-ga4-gtm-ads-remarketing.html - () https://prestashow.pl/pl/moduly-prestashop/28-prestashop-google-integrator-ga4-gtm-ads-remarketing.html - Product
CVSS v2 : unknown
v3 : 9.8 		v2 : unknown
v3 : 9.1
CPE cpe:2.3:a:prestashow:google_integrator:*:*:*:*:*:prestashop:*:*
Summary
  • (es) Vulnerabilidad de inyección SQL ciega en PrestaShow Google Integrator (complemento PrestaShop) permite la extracción y modificación de datos. Este ataque es posible mediante la inserción de un comando en una de las cookies.
First Time Prestashow
Prestashow google Integrator

08 Jan 2024, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-08 12:15

Updated : 2024-11-21 08:44

NVD link : CVE-2023-6921

Mitre link : CVE-2023-6921

CVE.ORG link : CVE-2023-6921

JSON object : View

Products Affected

prestashow

  • google_integrator
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')