ESLog inGet started free
High 7.5 CVSS 3.1 ordersexport Published on 2024-03-20

An issue in MyPrestaModules ordersexport v.6.0.2 and before allows a remote attacker to execute arbitrary code via the download.php component.

CVECVE-2024-28396 GHSANo GHSA advisory
View at the source View JSON Last modified at the source: 2026-06-17

Description

An issue in MyPrestaModules ordersexport v.6.0.2 and before allows a remote attacker to execute arbitrary code via the download.php component.

Original text by NVD (NIST), public domain.

CVSS metrics 3.1

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · secondary
High 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vectorNetwork
ComplexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityNone
AvailabilityNone

References

Found a vulnerability?

Write to the PrestaShop core security team:

security-core@prestashop.com

Related advisories

Same module: ordersexport
All ordersexport advisories (3)
IDAdvisoryComponentSeverityAffected versionsPublishedFix
CVE-2023-46354 In the module "Orders (CSV, Excel) Export PRO" (ordersexport) < 5.2.0 from MyPrestaModules for PrestaShop, a guest can… ordersexport High 7.5 < 5.2.0 2023-12-06 No
CVE-2023-40923 MyPrestaModules ordersexport before v5.0 was discovered to contain multiple SQL injection vulnerabilities at send.php… ordersexport High 8.8 < 5.0 2023-11-15 Yes

Do you use the ordersexport module?

PrestaShield checks it from the outside, without FTP access, and alerts you of every new advisory that affects you.
Check if my shop is affected