CVE-2023-39645

{"id": "CVE-2023-39645", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2023-10-03T21:15:10.240", "references": [{"url": "https://security.friendsofpresta.org/modules/2023/09/26/tvcmspaymenticon.html", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Improper neutralization of SQL parameter in Theme Volty CMS Payment Icon module for PrestaShop. In the module \u201cTheme Volty CMS Payment Icon\u201d (tvcmspaymenticon) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions."}, {"lang": "es", "value": "Neutralizaci\u00f3n incorrecta del par\u00e1metro SQL en el m\u00f3dulo Theme Volty CMS Payment Icon para PrestaShop. En el m\u00f3dulo \u201cTheme Volty CMS Payment Icon\u201d (tvcmspaymenticon) hasta la versi\u00f3n 4.0.1 de Theme Volty para PrestaShop, un invitado puede realizar inyecci\u00f3n SQL en las versiones afectadas."}], "lastModified": "2023-10-05T15:16:41.543", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:themevolty:cms_payment_icon:*:*:*:*:*:prestashop:*:*", "vulnerable": true, "matchCriteriaId": "3483A11D-8685-4477-A8BE-BE00C95AA46A", "versionEndExcluding": "4.0.2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}