CVE-2024-9201

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-9201
The SEUR plugin, in its versions prior to 2.5.11, is vulnerable to time-based SQL injection through the use of the ‘id_order’ parameter of the ‘/modules/seur/ajax/saveCodFee.php’ endpoint.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-vulnerability-seur-plugin Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:seur:seur:*:*:*:*:*:prestashop:*:*
History

16 Oct 2024, 16:55

Type Values Removed Values Added
CPE cpe:2.3:a:seur:seur:*:*:*:*:*:prestashop:*:*
First Time Seur
Seur seur
CVSS v2 : unknown
v3 : 9.4 		v2 : unknown
v3 : 9.8
References () https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-vulnerability-seur-plugin - () https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-vulnerability-seur-plugin - Third Party Advisory
Summary
  • (es) El complemento SEUR, en sus versiones anteriores a la 2.5.11, es vulnerable a la inyección SQL basada en tiempo mediante el uso del parámetro 'id_order' del endpoint '/modules/seur/ajax/saveCodFee.php'.

10 Oct 2024, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-10 11:15

Updated : 2024-10-16 16:55

NVD link : CVE-2024-9201

Mitre link : CVE-2024-9201

CVE.ORG link : CVE-2024-9201

JSON object : View

Products Affected

seur

  • seur
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')