ESLog inGet started free
Medium 5.0 CVSS 2.0 mpay24 Published on 2014-09-12

The mPAY24 payment module before 1.6 for PrestaShop allows remote attackers to obtain credentials, the installation path, and other sensitive information via…

CVECVE-2014-2009 GHSANo GHSA advisory
View at the source View JSON Last modified at the source: 2026-06-17

Description

The mPAY24 payment module before 1.6 for PrestaShop allows remote attackers to obtain credentials, the installation path, and other sensitive information via a direct request to api/curllog.log.

Original text by NVD (NIST), public domain.

CVSS metrics 2.0

Source: nvd@nist.gov · primary
Medium 5.0
AV:N/AC:L/Au:N/C:P/I:N/A:N
ConfidentialityPARTIAL
IntegrityNone
AvailabilityNone

References

Found a vulnerability?

Write to the PrestaShop core security team:

security-core@prestashop.com

Related advisories

Same module: mpay24
All mpay24 advisories (2)
IDAdvisoryComponentSeverityAffected versionsPublishedFix
CVE-2014-2008 SQL injection vulnerability in confirm.php in the mPAY24 payment module before 1.6 for PrestaShop allows remote… mpay24 High 7.5 ≤ 1.5.1
= 1.4.0
= 1.4.1
+9 2014-09-12 Yes

Do you use the mpay24 module?

PrestaShield checks it from the outside, without FTP access, and alerts you of every new advisory that affects you.
Check if my shop is affected