In the module "Referral and Affiliation Program" ...
Critical severity
Unreviewed
Published
Oct 25, 2023
to the GitHub Advisory Database
•
Updated Nov 10, 2023
Description
Published by the National Vulnerability Database
Oct 25, 2023
Published to the GitHub Advisory Database
Oct 25, 2023
Last updated
Nov 10, 2023
In the module "Referral and Affiliation Program" (referralbyphone) version 3.5.1 and before from Snegurka for PrestaShop, a guest can perform SQL injection. Method
ReferralByPhoneDefaultModuleFrontController::ajaxProcessCartRuleValidate
has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.References