GitHub Advisoryadvisory · Packagist

GHSA-8r4m-5p6p-52rp Arbitrary file read via SQL injection

HIGH Published 2023-04-26 Modified 2023-04-26 Official page ↗
Aliases
CVE-2023-30545
Ecosystem
Packagist
Packages
prestashop/prestashop
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-89
Reviewed
2023-04-26

Affected packages

• Packagist prestashop/prestashop: >= 8.0.0, < 8.0.4 → fixed in 8.0.4 • Packagist prestashop/prestashop: < 1.7.8.9 → fixed in 1.7.8.9

Description

Impact It is possible for a user having access to the SQL Manager (Advanced Options -> Database) to arbitrary read any file on the Operating system when using SQL function LOAD_FILE in a SELECT request. So It can access to critical information. Patches The patch will be on PS 8.0.4 and PS 1.7.8.9

Related

Alias · CVE (1)

  • CVE-2023-30545 PrestaShop is an Open Source e-commerce web application. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References