Cyber Posture

CVE-2025-69633

Critical

Published: 13 February 2026

Published
13 February 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0012 30.6th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

A SQL Injection vulnerability in the Advanced Popup Creator (advancedpopupcreator) module for PrestaShop 1.1.26 through 1.2.6 (Fixed in version 1.2.7) allows remote unauthenticated attackers to execute arbitrary SQL queries via the fromController parameter in the popup controller. The parameter is…

more

passed unsanitized to SQL queries in classes/AdvancedPopup.php (getPopups() and updateVisits() functions).

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly prevents SQL injection by enforcing validation of unsanitized inputs like the fromController parameter before incorporation into SQL queries.

SI-2 Flaw Remediation good match
prevent

Ensures timely remediation of the specific SQL injection flaw through identification, reporting, and patching to Advanced Popup Creator version 1.2.7.

RA-5 Vulnerability Monitoring and Scanning good match
detect

Enables detection of SQL injection vulnerabilities like CVE-2025-69633 through regular automated scanning of web applications and modules.

Security SummaryAI

CVE-2025-69633 is a SQL injection vulnerability in the Advanced Popup Creator (advancedpopupcreator) module for PrestaShop, affecting versions 1.1.26 through 1.2.6. The flaw occurs because the fromController parameter in the popup controller is passed unsanitized to SQL queries within the getPopups() and updateVisits() functions in classes/AdvancedPopup.php, enabling remote unauthenticated attackers to execute arbitrary SQL queries. It has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-89.

Remote unauthenticated attackers can exploit this vulnerability over the network with low complexity and no privileges required. Successful exploitation allows arbitrary SQL query execution, potentially leading to high-impact compromise of confidentiality, integrity, and availability, such as data extraction, modification, or deletion from the PrestaShop database.

The vulnerability is fixed in Advanced Popup Creator version 1.2.7. Additional details are available in the module's PrestaShop Addons page at https://addons.prestashop.com/en/pop-up-gamification/23773-popup-on-entry-exit-popup-and-newsletter.html and the Esokia Labs advisory at https://labs.esokia.com/cve/cve-2025-69633/. Security practitioners should urge PrestaShop users to update the module immediately.

Details

CWE(s)
CWE-89

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

SQL injection in public-facing PrestaShop module enables exploitation of public-facing application (T1190) and arbitrary queries for data collection from databases (T1213.006).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References