CVE-2023-30149
published 2023-06-02CVE-2023-30149: SQL injection vulnerability in the City Autocomplete (cityautocomplete) module from ebewe.net for PrestaShop, prior to version 1.8.12 (for PrestaShop version…
PriorityP273critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
18.35%
96.9th percentile
SQL injection vulnerability in the City Autocomplete (cityautocomplete) module from ebewe.net for PrestaShop, prior to version 1.8.12 (for PrestaShop version 1.5/1.6) or prior to 2.0.3 (for PrestaShop version 1.7), allows remote attackers to execute arbitrary SQL commands via the type, input_name. or q parameter in the autocompletion.php front controller.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ebewe | city_autocomplete | < 1.8.12 | 1.8.12 |
| ebewe | city_autocomplete | < 2.0.3 | 2.0.3 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://addons.prestashop.com/fr/inscription-processus-de-commande/6097-city-autocomplete.htmlhttps://friends-of-presta.github.io/security-advisories/module/2023/06/01/cityautocomplete.htmlhttps://addons.prestashop.com/fr/inscription-processus-de-commande/6097-city-autocomplete.htmlhttps://friends-of-presta.github.io/security-advisories/module/2023/06/01/cityautocomplete.html
2023-06-02
Published