CVE-2014-2009 The mPAY24 payment module before 1.6 for PrestaShop allows remote attackers to obtain credentials, the installation path, and other sensitive information via a direct request to api/curllog.log.
MediumCVSS 5.0
EPSS 7.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The mPAY24 payment module before 1.6 for PrestaShop allows remote attackers to obtain credentials, the installation path, and other sensitive information via a direct request to api/curllog.log.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mpay24 project mpay24 | <= 1.5.1 | No fix listed |
| mpay24 project mpay24 | = 1.4.0 | No fix listed |
| mpay24 project mpay24 | = 1.4.1 | No fix listed |
| mpay24 project mpay24 | = 1.4.2 | No fix listed |
| mpay24 project mpay24 | = 1.4.3 | No fix listed |
| mpay24 project mpay24 | = 1.4.4 | No fix listed |
| mpay24 project mpay24 | = 1.4.5 | No fix listed |
| mpay24 project mpay24 | = 1.4.6 | No fix listed |
| mpay24 project mpay24 | = 1.4.7 | No fix listed |
| mpay24 project mpay24 | = 1.4.8 | No fix listed |
| mpay24 project mpay24 | = 1.4.9 | No fix listed |
| mpay24 project mpay24 | = 1.5.0 | No fix listed |
References
- 110738 vdb-entry
- packetstormsecurity.com exploit
- 20140903 Mpay24 prestashop payment module multiple vulnerabilities exploit mailing-list
- 34586 exploit
- 69560 exploit vdb-entry
- mpay24-cve20142009-info-disc(95721) vdb-entry