CVE-2023-28843

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

PrestaShop/paypal is an open source module for the PrestaShop web commerce ecosystem which provides paypal payment support. A SQL injection vulnerability found in the PrestaShop paypal module from release from 3.12.0 to and including 3.16.3 allow a remote attacker to gain privileges, modify data, and potentially affect system availability. The cause of this issue is that SQL queries were being constructed with user input which had not been properly filtered. Only deployments on PrestaShop 1.6 are affected. Users are advised to upgrade to module version 3.16.4. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
202ecommerce	paypal	>= 3.12.0, < 3.16.4

References

https://github.com/202ecommerce/paypal/commit/2f6884ea1d0fe4b58441699fcc1d6c56c7d733ebPatch
https://github.com/202ecommerce/paypal/security/advisories/GHSA-66pc-8gh8-mx7mExploit, Third Party Advisory
https://github.com/202ecommerce/paypal/commit/2f6884ea1d0fe4b58441699fcc1d6c56c7d733ebPatch
https://github.com/202ecommerce/paypal/security/advisories/GHSA-66pc-8gh8-mx7mExploit, Third Party Advisory

Timeline

Published: Mar 31, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-288446.5Nextcloud server is an open source home cloud implementation. In affected versions users that should not be able to download a file can stil CVE-2023-288453.5Nextcloud talk is a video & audio conferencing app for Nextcloud. In affected versions the talk app does not properly filter access to a con CVE-2023-288467.5Unpoly is a JavaScript framework for server-side web applications. There is a possible Denial of Service (DoS) vulnerability in the `unpoly-CVE-2023-288477.5Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server 24.0.0 prior to 24.0.11 CVE-2023-288485.4user_oidc is the OIDC connect user backend for Nextcloud, an open source collaboration platform. A vulnerability in versions 1.0.0 until 1.3 CVE-2023-288495.4GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.7, GLPI inventory endpoint can CVE-2023-28858.1Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in CBOT Chatbot allows Adversary in t CVE-2023-288505.4Pimcore Perspective Editor provides an editor for Pimcore that allows users to add/remove/edit custom views and perspectives. This vulnerabi CVE-2023-288515.4Silverstripe Form Capture provides a method to capture simple silverstripe forms and an admin interface for users. Starting in version 0.2.0 CVE-2023-288524.8GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to versions 9.5.13 and 10.0.7, a user with dash CVE-2023-288536.5Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Startin CVE-2023-288548.8nophp is a PHP web framework. Prior to version 0.0.1, nophp is vulnerable to shell command injection on httpd user. A patch was made availab