CVE-2014-2008

SQL injection vulnerability in confirm.php in the mPAY24 payment module before 1.6 for PrestaShop allows remote attackers to execute arbitrary SQL commands via the TID parameter.

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

2.64% chance of exploitation in the next 30 days, 84th percentile

Published

2014-09-12

Updated

2024-08-06

Proof-of-concept exploits (3)

• http://packetstormsecurity.com/files/128136/Mpay24-Payment-Module-1.5-Information-Disclos…
• http://seclists.org/fulldisclosure/2014/Sep/23
• http://www.exploit-db.com/exploits/34586

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/34586

References

• CVE Record
• NVD entry

Related

• CVE-2014-1990
• CVE-2014-2009
• CVE-2014-1982
• CVE-2014-2013
• CVE-2014-1947
• CVE-2014-2016