by Kastro
Paper/Archive/CVE-2023-39526

CVE-2023-39526

PrestaShop PrestaShop — PrestaShopSQL manager vulnerability (potential RCE)

EPSS 2%CVSS 9.8
critical.is priorityof 100
45
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 77.1.771 × 2015.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to remote code execution through SQL injection and arbitrary file write in the back office. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch. There are no known workarounds.

Affected

ProductAffectedFixed inSource
PrestaShop< 1.7.8.10–CNA
PrestaShop>= 8.0.0, < 8.0.5–CNA
PrestaShop= 8.1.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/PrestaShop/PrestaShop/security/advisories/GHSA-gf46-prm4-56pcrefgithub.com/PrestaShop/PrestaShop/commit/817847e2347844a9b6add017581f1932bcd28c09