CVE-2023-26861
Description
SQL injection vulnerability found in PrestaShop vivawallet v.1.7.10 and before allows a remote attacker to gain privileges via the vivawallet() module.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- PrestaShop/vivawalletdescription
- Range: <=1.7.10
Patches
Vulnerability mechanics
Root cause
"The vivawallet module fails to properly sanitize SQL query parameters, allowing for SQL injection."
Attack vector
An attacker can exploit this vulnerability by sending a crafted request to the `fail.php`, `success.php`, or `webhook.php` controllers within the vivawallet module. The vulnerability lies in the handling of the `s` GET parameter, which is directly incorporated into SQL queries without adequate sanitization. This allows an attacker to manipulate the query to gain unauthorized access or modify data [ref_id=1]. The attack can be performed remotely and requires no user interaction [ref_id=1].
Affected code
The vulnerability exists in the `fail.php` and `success.php` files within the `vivawallet` module. Specifically, the code responsible for processing the `s` GET parameter and constructing SQL queries is affected. The patch modifies these files to implement proper SQL parameter sanitization [ref_id=1].
What the fix does
The patch replaces the use of `stripslashes()` with `pSQL()` for the `OrderCode` parameter in `fail.php` and `success.php`. The `pSQL()` function is designed to properly escape SQL queries, preventing malicious SQL code from being injected. This change ensures that user-supplied data is treated as literal values rather than executable SQL commands, thereby closing the SQL injection vulnerability [ref_id=1].
Preconditions
- configThe vivawallet module must be installed on the PrestaShop instance.
- inputThe attacker needs to send a request with a specially crafted 's' GET parameter.
Generated on Jun 7, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
3News mentions
0No linked articles in our index yet.