CVE-2024-28388

Name of the Vulnerable Software and Affected Versions SunnyToo stproductcomments module for PrestaShop versions 1.0.5 and earlier

Description The issue allows a remote attacker to escalate privileges and obtain sensitive information via the StProductCommentClass::getListcomments method. This is a SQL injection vulnerability.

Recommendations For versions 1.0.5 and earlier, consider disabling the StProductCommentClass::getListcomments method until a patch is available to prevent exploitation. Restrict access to sensitive information and privileges to minimize the risk of escalation.