GitHub Advisoryadvisory · Packagist

GHSA-gf46-prm4-56pc PrestaShop SQL manager vulnerability

CRITICAL Published 2023-08-09 Modified 2023-08-09 Official page ↗
Aliases
CVE-2023-39526
Ecosystem
Packagist
Packages
prestashop/prestashop
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2023-08-09

Affected packages

• Packagist prestashop/prestashop: >= 8.1.0, < 8.1.1 → fixed in 8.1.1 • Packagist prestashop/prestashop: >= 8.0.0, < 8.0.5 → fixed in 8.0.5 • Packagist prestashop/prestashop: < 1.7.8.10 → fixed in 1.7.8.10

Description

Impact Remote code execution through SQL injection and arbitrary file write in back office Patches 1.7.8.10 8.0.5 8.1.1 Found by Truff (via yeswehack) Workarounds none References none

Related

Alias · CVE (1)

  • CVE-2023-39526 PrestaShop is an open source e-commerce web application. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References