CVE-2023-46347
Published: 25 October 2023
Summary
CVE-2023-46347 is a critical-severity SQL Injection (CWE-89) vulnerability in Ndkdesign Ndk Steppingpack. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 1.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
In the module "Step by Step products Pack" (ndk_steppingpack) version 1.5.6 and earlier from NDK Design for PrestaShop, a SQL injection vulnerability exists in the method NdkSpack::getPacks(). The flaw stems from unsanitized SQL calls that accept attacker input via ordinary HTTP requests, allowing direct manipulation of database queries. The issue is tracked as CVE-2023-46347 with a CVSS v3.1 score of 9.8 and is classified under CWE-89.
An unauthenticated remote attacker can exploit the vulnerability simply by sending crafted HTTP requests to the affected PrestaShop module. Successful exploitation grants full read/write access to the database, enabling data exfiltration, modification of records, or further compromise of the underlying shop installation.
The advisory published by Friends of Presta at https://security.friendsofpresta.org/modules/2023/10/24/ndk_steppingpack.html recommends that merchants update or remove the ndk_steppingpack module to eliminate the injectable code paths.
The EPSS score reached a peak of 0.7970, indicating substantial post-disclosure exploitation interest, before receding to the current value of 0.7021.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-50567
Vulnerability details
In the module "Step by Step products Pack" (ndk_steppingpack) version 1.5.6 and before from NDK Design for PrestaShop, a guest can perform SQL injection. The method `NdkSpack::getPacks()` has sensitive SQL calls that can be executed with a trivial http call…
more
and exploited to forge a SQL injection.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.