CVE-2024-25847
Last modified
CVE-2024-25847 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. SQL Injection vulnerability in MyPrestaModules "Product Catalog (CSV, Excel) Import" (simpleimportproduct) modules for PrestaShop versions 6.5.0 and before, allows attackers to escalate privileges and obtain sensitive information via Send::__construct() and importProducts::_addDataToDb methods.. EPSS estimates a 0.53% chance of exploitation in the next 30 days.
Description
SQL Injection vulnerability in MyPrestaModules "Product Catalog (CSV, Excel) Import" (simpleimportproduct) modules for PrestaShop versions 6.5.0 and before, allows attackers to escalate privileges and obtain sensitive information via Send::__construct() and importProducts::_addDataToDb methods.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Myprestamodules | Product Catalog \(Csv\, Excel\) Import | <= 6.5.0 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-25847?
How severe is CVE-2024-25847?
How do I fix CVE-2024-25847?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-25841In the module "So Flexibilite" (soflexibilite) from Common-S…5.9
- CVE-2024-25842An issue was discovered in Presta World "Account Manager - S…7.5
- CVE-2024-25843In the module "Import/Update Bulk Product from any Csv/Excel…9.8
- CVE-2024-25844An issue was discovered in Common-Services "So Flexibilite" …7.5
- CVE-2024-25845In the module "CD Custom Fields 4 Orders" (cdcustomfields4or…9.8
- CVE-2024-25846In the module "Product Catalog (CSV, Excel) Import" (simplei…9.1
- CVE-2024-25848In the module "Ever Ultimate SEO" (everpsseo) <= 8.1.2 from …5.9
- CVE-2024-25849In the module "Make an offer" (makeanoffer) <= 1.7.1 from Pr…9.8
- CVE-2024-2585Vulnerability in AMSS++ version 4.31 that allows SQL injecti…7.5
- CVE-2024-25850Netis WF2780 v2.1.40144 was discovered to contain a command …9.8
- CVE-2024-25851Netis WF2780 v2.1.40144 was discovered to contain a command …8
- CVE-2024-25852Linksys RE7000 v2.0.9, v2.0.11, and v2.0.15 have a command e…8.8
Are you affected by CVE-2024-25847?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST