Vulnerability · Published Jun 27, 2022 · Assigned by GitHub_M
CVE-2022-31101SQL Injection in prestashop/blockwishlist
High 8.1
In plain English
A high-severity SQL injection in blockwishlist from PrestaShop. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 23.5% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can perform SQL injection. This issue is fixed in version 2.1.1. Users are advised to upgrade. There are no known workarounds for this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | prestashop/blockwishlist | 2.1.1 | GHSA-2jx3-5j9v-prpp |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PrestaShop | blockwishlist | >= 2.0.0, < 2.1.1 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
References
- https://github.com/PrestaShop/blockwishlist/security/advisories/GHSA-2jx3-5j9v-prpp x_refsource_CONFIRM
- https://github.com/PrestaShop/blockwishlist/commit/b3ec4b85af5fd73f74d55390b226d221298ca084 x_refsource_MISC
- http://packetstormsecurity.com/files/168003/Prestashop-Blockwishlist-2.1.0-SQL-Injection.html x_refsource_MISC