CVE-2023-47308
Critical
Description
In the module "Newsletter Popup PRO with Voucher/Coupon code" (newsletterpop) before version 2.6.1 from Active Design for PrestaShop, a guest can perform SQL injection in affected versions. The method `NewsletterpopsendVerificationModuleFrontController::checkEmailSubscription()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.
SeverityCritical
CVSS9.8
Exploit probability—
ProductActivedesign Newsletterpop
PublishedNov 15, 2023
First seenNov 15, 2023
How to fix
Update
- activedesign newsletterpop2.6.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| activedesign newsletterpop | 2.3.1 ≤ v ≤ 2.4.53, 2.5.2 ≤ v < 2.6.1 | 2.6.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.