In the module "Order Duplicator " Clone and Delete...
High severity
Unreviewed
Published
Nov 8, 2023
to the GitHub Advisory Database
•
Updated Nov 15, 2023
Description
Published by the National Vulnerability Database
Nov 7, 2023
Published to the GitHub Advisory Database
Nov 8, 2023
Last updated
Nov 15, 2023
In the module "Order Duplicator " Clone and Delete Existing Order" (orderduplicate) in version <= 1.1.7 from Silbersaiten for PrestaShop, a guest can download personal information without restriction. Due to a lack of permissions control, a guest can download personal information from ps_customer/ps_address tables such as name / surname / phone number / full postal address.
References