Promokit vulnerabilities
We track 4 vulnerabilities in Promokit products across 5 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on June 24, 2024.
Latest Promokit vulnerabilities
- 9.8 Critical severity
pk_isotope: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in the module "Isotope" (pk_isotope) <=1.7.3 from Promokit.eu for PrestaShop allows attackers to obtain sensitive information and cause other impacts via `pk_isotope::saveData` and `pk_isotope::removeData` methods.
- 9.8 Critical severity
pk_customlinks: Improper Neutralization of Special Elements used in an SQL Command
In the module "Custom links" (pk_customlinks) <= 2.3 from Promokit.eu for PrestaShop, a guest can perform SQL injection. The script ajax.php have a sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL injection.
- 7.5 High severity
pkfacebook: Improper Neutralization of Special Elements used in an SQL Command
In the module "Facebook" (pkfacebook) <=1.0.1 from Promokit.eu for PrestaShop, a guest can perform SQL injection. The ajax script facebookConnect.php have a sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL injection
- 9.8 Critical severity
promokit: Improper Neutralization of Special Elements used in an SQL Command
In the module "Theme settings" (pk_themesettings) <= 1.8.8 from Promokit.eu for PrestaShop, a guest can perform SQL injection. The script ajax.php have a sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL injection.