Vulnerability · Published Aug 7, 2023 · Assigned by GitHub_M
CVE-2023-39526PrestaShopSQL manager vulnerability (potential RCE)
Critical 9.1
In plain English
A critical-severity SQL injection in PrestaShop from PrestaShop. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to remote code execution through SQL injection and arbitrary file write in the back office. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch. There are no known workarounds.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | prestashop/prestashop | 8.1.1 | GHSA-gf46-prm4-56pc |
| Packagist | prestashop/prestashop | 8.0.5 | GHSA-gf46-prm4-56pc |
| Packagist | prestashop/prestashop | 1.7.8.10 | GHSA-gf46-prm4-56pc |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PrestaShop | PrestaShop | < 1.7.8.10>= 8.0.0, < 8.0.5= 8.1.0 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H