CVE-2023-6921

SQL Injection in PrestaShop Google Integrator

State: Published
Severity: 9.8 Critical
Published: Jan 8, 2024
Updated: Jun 16, 2025
Reserved: Dec 18, 2023

Description

Blind SQL Injection vulnerability in PrestaShow Google Integrator (PrestaShop addon) allows for data extraction and modification. This attack is possible via command insertion in one of the cookies.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CERT-PL

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

Product	Versions
PrestaShop Google IntegratorPrestaShow	before 2.1.4Affected

References

https://prestashow.pl/pl/moduly-prestashop/28-prestashop-google-integrator-ga4-gtm-ads-remarketing.htmlproduct
https://cert.pl/en/posts/2024/01/CVE-2023-6921/
https://cert.pl/posts/2024/01/CVE-2023-6921/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.