CVE-2023-39652
Description
theme volty tvcmsvideotab up to v4.0.0 was discovered to contain a SQL injection vulnerability via the component TvcmsVideoTabConfirmDeleteModuleFrontController::run().
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- volty theme/tvcmsvideotabdescription
- Range: <=4.0.0
Patches
Vulnerability mechanics
Root cause
"The TvcmsVideoTabConfirmDeleteModuleFrontController::run() method improperly neutralizes SQL parameters, allowing for SQL injection."
Attack vector
An unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request to the `TvcmsVideoTabConfirmDeleteModuleFrontController::run()` endpoint. The request can include malicious SQL code within the `id` or `id_lang` parameters. This allows the attacker to inject arbitrary SQL queries into the application's database. The vulnerability is present in versions up to 4.0.0 of the tvcmsvideotab module [ref_id=1].
Affected code
The vulnerability resides in the `TvcmsVideoTabConfirmDeleteModuleFrontController::run()` method within the `confirmdelete.php` file. Specifically, the lines where `Tools::getValue('id')` and `Tools::getValue('id_lang')` are retrieved are affected [ref_id=1].
What the fix does
The patch addresses the SQL injection vulnerability by ensuring that the `id` and `id_lang` parameters are properly cast to integers before being used in SQL queries. This type casting prevents malicious SQL code from being interpreted as part of the query, thereby mitigating the risk of SQL injection. The fix is implemented in version 4.0.1 of the module [ref_id=1].
Preconditions
- inputThe attacker must provide crafted values for the 'id' and 'id_lang' parameters in the HTTP request.
- networkThe vulnerability is accessible via network requests.
- authNo authentication is required to exploit this vulnerability.
Generated on Jun 6, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
2News mentions
0No linked articles in our index yet.