GitHub Advisoryadvisory · Packagist

GHSA-6xxj-gcjq-wgf4 SQL injection in prestashop/prestashop

HIGH Published 2021-12-07 Modified 2021-12-08 Official page ↗
Aliases
CVE-2021-43789
Ecosystem
Packagist
Packages
prestashop/prestashop
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-89
Reviewed
2021-12-07

Affected packages

• Packagist prestashop/prestashop: >= 1.7.5.0, < 1.7.8.2 → fixed in 1.7.8.2

Description

Impact Blind SQLi using Search filters with `orderBy` and `sortOrder` parameters Patches The problem is fixed in 1.7.8.2

Related

Alias · CVE (1)

  • CVE-2021-43789 PrestaShop is an Open Source e-commerce web application. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References