CVE-2024-36680

published 2024-06-19

CVE-2024-36680: In the module "Facebook" (pkfacebook) <=1.0.1 from Promokit.eu for PrestaShop, a guest can perform SQL injection. The ajax script facebookConnect.php have a…

Priority P2 78 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

ITW VulnCheck KEV

In the module "Facebook" (pkfacebook) <=1.0.1 from Promokit.eu for PrestaShop, a guest can perform SQL injection. The ajax script facebookConnect.php have a sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL injection.

Detection & IOCs extracted from sources · hover to see the quote

path facebookConnect.php↗

• → Monitor HTTP requests to facebookConnect.php in the pkfacebook (pkfacebook) module directory for anomalous or unsanitized SQL-injectable parameters, as exploitation requires only a trivial HTTP call. ↗
• → CVE-2024-36680 has been actively exploited to deploy card skimmers on PrestaShop e-commerce sites; investigate for injected skimmer scripts in site assets following exploitation. ↗

• · Vulnerability affects pkfacebook module versions <=1.0.1 only; sites running a patched version above 1.0.1 are not affected. ↗
• · The SQL injection is unauthenticated (guest-accessible), meaning no credentials are required to exploit the vulnerable endpoint. ↗

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vulncheck 7.5 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89