Vulnerability · Published Aug 1, 2022 · Assigned by GitHub_M
CVE-2022-31181Remote code execution in prestashop
Critical 9.8
In plain English
A critical-severity SQL injection in PrestaShop from PrestaShop. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.7% (higher than 94% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
PrestaShop is an Open Source e-commerce platform. In versions from 1.6.0.10 and before 1.7.8.7 PrestaShop is subject to an SQL injection vulnerability which can be chained to call PHP's Eval function on attacker input. The problem is fixed in version 1.7.8.7. Users are advised to upgrade. Users unable to upgrade may delete the MySQL Smarty cache feature.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | prestashop/prestashop | 1.7.8.7 | GHSA-hrgx-p36p-89q4 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PrestaShop | PrestaShop | >= 1.6.0.10, < 1.7.8.7 |
Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H