CVE-2023-46347

CRÍTICO 9.8CVE-2023-46347 · Published 25/10/2023 · updated 17/06/2026

En resumen

CVE-2023-46347 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a ndk steppingpack (ndkdesign).
Probabilidad de explotación en los próximos 30 días (EPSS): 50.3%, mayor que el 98.9% de las vulnerabilidades.
Solución: actualizar a 1.5.7 o posterior.

Package	Affected versions	Patched versions
ndk steppingpack ndkdesign	`< 1.5.7`	`1.5.7`

Description

In the module "Step by Step products Pack" (ndk_steppingpack) version 1.5.6 and before from NDK Design for PrestaShop, a guest can perform SQL injection. The method `NdkSpack::getPacks()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.

References

security.friendsofpresta.org/modules/2023/10/24/ndk_steppingpack.html · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free