Is CVE-2023-28843 actively exploited?

No active exploitation of CVE-2023-28843 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2023-28843 be exploited remotely?

Yes. CVE-2023-28843 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2023-28843?

CVE-2023-28843 has a CVSS score of 9.8 (CRITICAL).

HOME VULNERABILITIESCVE-2023-28843

CRITICAL

CVE-2023-28843

CWE-89Published: March 31, 2023· Updated: Jun 17, 2026

9.8

CVSS v3.1

Official Description

PrestaShop/paypal is an open source module for the PrestaShop web commerce ecosystem which provides paypal payment support. A SQL injection vulnerability found in the PrestaShop paypal module from release from 3.12.0 to and including 3.16.3 allow a remote attacker to gain privileges, modify data, and potentially affect system availability. The cause of this issue is that SQL queries were being constructed with user input which had not been properly filtered. Only deployments on PrestaShop 1.6 are affected. Users are advised to upgrade to module version 3.16.4. There are no known workarounds for this vulnerability.

NVD Source

Risk Analysis

A SQL injection vulnerability exists in the PrestaShop PayPal module due to improper filtering of user input. This critical flaw allows remote attackers to gain unauthorized privileges and modify data on affected PrestaShop 1.6 deployments.

No public exploit is known, and it is not listed in the CISA KEV. The vulnerability is remotely exploitable with low attack complexity.

Recommended Action

Administrators must upgrade the PayPal module to version 3.16.4. No workarounds are available.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2023-28843 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.

From a weakness classification perspective (CWE-89): SQL injection vulnerabilities allow attackers to manipulate database queries, potentially exposing or modifying sensitive data.