CVE-2023-30192
Published: 12 May 2023
Summary
CVE-2023-30192 is a critical-severity SQL Injection (CWE-89) vulnerability in Prestashop Possearchproducts. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 2.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Prestashop possearchproducts module version 1.7 is affected by a SQL injection vulnerability in the PosSearch::find() method, tracked as CVE-2023-30192 with a CVSS 3.1 score of 9.8 and mapped to CWE-89. The flaw resides in a search-related component commonly used with Prestashop e-commerce sites.
Unauthenticated attackers with network access can supply crafted input to the vulnerable function, enabling arbitrary SQL execution that may expose, alter, or delete database contents and potentially lead to full application compromise.
Public advisories published by Friends-of-Presta on 11 May 2023 reference the module sold by Posthemes and provide details for affected users. The associated EPSS score reached a peak of 0.5447 before receding to its current value of 0.4458.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-34617
Vulnerability details
Prestashop possearchproducts 1.7 is vulnerable to SQL Injection via PosSearch::find().
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.