Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1nZjQ2LXBybTQtNTZwY84AA1LW

PrestaShop SQL manager vulnerability

Impact

Remote code execution through SQL injection and arbitrary file write in back office

Patches

1.7.8.10
8.0.5
8.1.1

Found by

Truff (via yeswehack)

Workarounds

none

References

none

Permalink: https://github.com/advisories/GHSA-gf46-prm4-56pc
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nZjQ2LXBybTQtNTZwY84AA1LW
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: 9 months ago
Updated: 6 months ago

CVSS Score: 9.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Identifiers: GHSA-gf46-prm4-56pc, CVE-2023-39526
References:

• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-gf46-prm4-56pc
• https://nvd.nist.gov/vuln/detail/CVE-2023-39526
• https://github.com/PrestaShop/PrestaShop/commit/817847e2347844a9b6add017581f1932bcd28c09
• https://github.com/advisories/GHSA-gf46-prm4-56pc

Repository: https://github.com/PrestaShop/PrestaShop
Blast Radius: 2.7

Affected Packages