Vulnerability · Published Dec 7, 2021 · Assigned by GitHub_M
CVE-2021-43789Blind SQLi using Search filters in PrestaShop
High 7.5
In plain English
A high-severity SQL injection in PrestaShop from PrestaShop. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.7% (higher than 92% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)4.7%top 8.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
PrestaShop is an Open Source e-commerce web application. Versions of PrestaShop prior to 1.7.8.2 are vulnerable to blind SQL injection using search filters with `orderBy` and `sortOrder` parameters. The problem is fixed in version 1.7.8.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | prestashop/prestashop | 1.7.8.2 | GHSA-6xxj-gcjq-wgf4 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PrestaShop | PrestaShop | >= 1.7.5.0, <= 1.7.8.1 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-6xxj-gcjq-wgf4 x_refsource_CONFIRM
- https://github.com/PrestaShop/PrestaShop/issues/26623 x_refsource_MISC
- https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.8.2 x_refsource_MISC