CVE-2023-46348

SQL njection vulnerability in SunnyToo sturls before version 1.1.13, allows attackers to escalate privileges and obtain sensitive information via StUrls::hookActionDispatcher and StUrls::getInstanceId methods.

Score

CVSS 3.1 9.8 Critical

Status

Modified - cve@mitre.org

Published

2023-12-14

Last modified

2024-08-02

Weaknesses

CWE-89

Affected products

• Sturls (Sunnytoo)

References

• https://security.friendsofpresta.org/modules/2023/12/07/sturls.html