CVE-2023-26861

critical

Description

SQL injection vulnerability found in PrestaShop vivawallet v.1.7.10 and before allows a remote attacker to gain privileges via the vivawallet() module.

References

https://security.friendsofpresta.org/modules/2023/07/11/vivawallet.html

https://github.com/VivaPayments/API/commit/c1169680508c6e144d3e102ebdb257612e4cd84a

https://addons.prestashop.com/fr/paiement/89363-viva-wallet-smart-checkout.html

Details

Source: Mitre, NVD

Published: 2023-07-11

Updated: 2023-07-18

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H