Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2023-30154: Multiple improper neutralization of SQL parameters in module AfterMail (aftermailpresta) for PrestaShop, before version 2.2.1, allows remote attackers to perform SQL injection attacks via `id_custo...
CVE-2023-30154 · published 3 years ago
Summary
Multiple improper neutralization of SQL parameters in module AfterMail (aftermailpresta) for PrestaShop, before version 2.2.1, allows remote attackers to perform SQL injection attacks via `id_customer`, `id_conf`, `id_product` and `token` parameters in `aftermailajax.php via the 'id_product' paramet...
What to do
- Update shoprunners aftermail to version 2.2.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| shoprunners | aftermail |
< 2.2.1 cpe:2.3:a:shoprunners:aftermail:*:*:*:*:*:prestashop:*:* |
Original advisory text
Multiple improper neutralization of SQL parameters in module AfterMail (aftermailpresta) for PrestaShop, before version 2.2.1, allows remote attackers to perform SQL injection attacks via `id_custo...
Multiple improper neutralization of SQL parameters in module AfterMail (aftermailpresta) for PrestaShop, before version 2.2.1, allows remote attackers to perform SQL injection attacks via `id_customer`, `id_conf`, `id_product` and `token` parameters in `aftermailajax.php via the 'id_product' parameter in hooks DisplayRightColumnProduct and DisplayProductButtons.
References
- https://security.friendsofpresta.org/modules/2023/10/10/aftermailpresta.html Patch Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-89SQL Injection
Timeline
Published14 Oct 2023
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2023-30154 · NVD
Track software like this
Free during beta