CVE-2024-25849: Prestatoolkit Make An Offer/offer Your Price

Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days.

In the module "Make an offer" (makeanoffer) <= 1.7.1 from PrestaToolKit for PrestaShop, a guest can perform SQL injection via MakeOffers::checkUserExistingOffer()` and `MakeOffers::addUserOffer()` .

Affected products

• Prestatoolkit Make An Offer/offer Your Price: up to and including 1.7.1

Published 2024-03-08. Last modified 2026-06-17.