CVE-2024-36684: Prestashop Pk Customlinks

Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days.

In the module "Custom links" (pk_customlinks) <= 2.3 from Promokit.eu for PrestaShop, a guest can perform SQL injection. The script ajax.php have a sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL injection.

Affected products

• Prestashop Pk Customlinks: up to and including 2.3

Published 2024-06-19. Last modified 2026-06-17.