Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1ocmd4LXAzNnAtODlxNM4AAtvN

PrestaShop eval injection possible if shop vulnerable to SQL injection

Impact

Eval injection possible if the shop is vulnerable to an SQL injection.

Patches

The problem is fixed in version 1.7.8.7

Workarounds

Delete the MySQL Smarty cache feature by removing these lines in the file config/smarty.config.inc.php lines 43-46 (PrestaShop 1.7) or 40-43 (PrestaShop 1.6):

if (Configuration::get('PS_SMARTY_CACHING_TYPE') == 'mysql') {
    include _PS_CLASS_DIR_.'Smarty/SmartyCacheResourceMysql.php';
    $smarty->caching_type = 'mysql';
}

Permalink: https://github.com/advisories/GHSA-hrgx-p36p-89q4
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ocmd4LXAzNnAtODlxNM4AAtvN
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 1 year ago
Updated: about 1 year ago

CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-hrgx-p36p-89q4, CVE-2022-31181
References:

• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-hrgx-p36p-89q4
• https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.8.7
• https://nvd.nist.gov/vuln/detail/CVE-2022-31181
• https://github.com/PrestaShop/PrestaShop/commit/b6d96e7c2a4e35a44e96ffbcdfd34439b56af804
• https://github.com/advisories/GHSA-hrgx-p36p-89q4

Repository: https://github.com/PrestaShop/PrestaShop
Blast Radius: 3.0

Affected Packages