by Kastro
Paper/Archive/CVE-2022-31181

CVE-2022-31181

PrestaShop PrestaShop — Remote code execution in prestashop

EPSS 7%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (NVD, CNA agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 93.9.939 × 2018.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

PrestaShop is an Open Source e-commerce platform. In versions from 1.6.0.10 and before 1.7.8.7 PrestaShop is subject to an SQL injection vulnerability which can be chained to call PHP's Eval function on attacker input. The problem is fixed in version 1.7.8.7. Users are advised to upgrade. Users unable to upgrade may delete the MySQL Smarty cache feature.

Affected

ProductAffectedFixed inSource
PrestaShop>= 1.6.0.10, < 1.7.8.7–CNA

Scores by source

GitHub_M (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/PrestaShop/PrestaShop/security/advisories/GHSA-hrgx-p36p-89q4refgithub.com/PrestaShop/PrestaShop/commit/b6d96e7c2a4e35a44e96ffbcdfd34439b56af804refgithub.com/PrestaShop/PrestaShop/releases/tag/1.7.8.7