Description
Snegurka for PrestaShop模块中的“Referral and Affiliation Program”（推荐和联盟计划）版本3.5.1及之前版本中存在漏洞。通过在方法'ReferralByPhoneDefaultModuleFrontController::ajaxProcessCartRuleValidate'中执行敏感的SQL调用，攻击者可以利用简单的HTTP请求进行SQL注入攻击，从而伪造SQL查询并获取敏感信息。
PrestaShop SQL 注入漏洞（CVE-2023-46358）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://security.friendsofpresta.org/modules/2023/10/24/referralbyphone.html
https://nvd.nist.gov/vuln/detail/CVE-2023-46358
https://avd.aliyun.com/detail?id=AVD-2023-46358
https://cve.imfht.com/detail/CVE-2023-46358
https://osv.dev/vulnerability/CVE-2023-46358
https://access.redhat.com/security/cve/cve-2023-46358
https://devhub.checkmarx.com/cve-details/cve-2023-46358/
https://stack.chaitin.com/poc/detail/3978