CVE-2014-2008 SQL injection vulnerability in confirm.php in the mPAY24 payment module before 1.6 for PrestaShop allows remote attackers to execute arbitrary SQL commands via the TID parameter.
HighCVSS 7.5
EPSS 2.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQL injection vulnerability in confirm.php in the mPAY24 payment module before 1.6 for PrestaShop allows remote attackers to execute arbitrary SQL commands via the TID parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mpay24 project mpay24 | <= 1.5.1 | No fix listed |
| mpay24 project mpay24 | = 1.4.0 | No fix listed |
| mpay24 project mpay24 | = 1.4.1 | No fix listed |
| mpay24 project mpay24 | = 1.4.2 | No fix listed |
| mpay24 project mpay24 | = 1.4.3 | No fix listed |
| mpay24 project mpay24 | = 1.4.4 | No fix listed |
| mpay24 project mpay24 | = 1.4.5 | No fix listed |
| mpay24 project mpay24 | = 1.4.6 | No fix listed |
| mpay24 project mpay24 | = 1.4.7 | No fix listed |
| mpay24 project mpay24 | = 1.4.8 | No fix listed |
| mpay24 project mpay24 | = 1.4.9 | No fix listed |
| mpay24 project mpay24 | = 1.5.0 | No fix listed |
References
- 110737 vdb-entry
- packetstormsecurity.com exploit patch
- 20140903 Mpay24 prestashop payment module multiple vulnerabilities exploit mailing-list patch
- 34586 exploit patch
- 69560 exploit vdb-entry
- mpay24-cve20142008-sql-injection(95720) vdb-entry