ESLog inGet started free
High 7.5 CVSS 3.1 ndk_advanced_custom_fields Published on 2022-11-01

A SQL injection vulnerability in the height and width parameter in NdkAdvancedCustomizationFields v3.5.0 allows unauthenticated attackers to exfiltrate…

CVECVE-2022-40839 GHSANo GHSA advisory
View at the source View JSON Last modified at the source: 2026-07-09

Description

A SQL injection vulnerability in the height and width parameter in NdkAdvancedCustomizationFields v3.5.0 allows unauthenticated attackers to exfiltrate database data.

Original text by NVD (NIST), public domain.

CVSS metrics 3.1

Source: nvd@nist.gov · primary
High 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vectorNetwork
ComplexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityNone
AvailabilityNone

References

Found a vulnerability?

Write to the PrestaShop core security team:

security-core@prestashop.com

Related advisories

Same module: ndk_advanced_custom_fields
All ndk_advanced_custom_fields advisories (4)
IDAdvisoryComponentSeverityAffected versionsPublishedFix
CVE-2022-40841 A cross-site scripting (XSS) vulnerability in NdkAdvancedCustomizationFields v3.5.0 allows attackers to execute… ndk_advanced_custom_fields Medium 6.1 ≤ 3.5.0 2022-12-21 No
CVE-2022-40842 ndk design NdkAdvancedCustomizationFields 3.5.0 is vulnerable to Server-side request forgery (SSRF) via rotateimg.php. ndk_advanced_custom_fields Critical 9.1 ≤ 3.5.0 2022-11-22 No
CVE-2022-40840 ndk design NdkAdvancedCustomizationFields 3.5.0 is vulnerable to Cross Site Scripting (XSS) via createPdf.php. ndk_advanced_custom_fields Medium 6.1 ≤ 3.5.0 2022-11-02 No

Do you use the ndk_advanced_custom_fields module?

PrestaShield checks it from the outside, without FTP access, and alerts you of every new advisory that affects you.
Check if my shop is affected