Blind SQL Injection in PrestaShop
28Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendepss 11%
from disclosure to weapon197 days
Published on NVDSep 24
1st PoC+197d
exploitation probability
11%top 5% of all CVEs
observed exploitation
nono source reports it
2 public exploit(s)
PrestaShop from version 1.7.5.0 and before version 1.7.6.8 is vulnerable to a blind SQL Injection attack in the Catalog Product edition page with location parameter. The problem is fixed in 1.7.6.8
Affected products
PrestaShop · PrestaShoppublic PoCs found — 2
exploitdbwww.exploit-db.com/exploits/49755unverifiedcve_referencepacketstormsecurity.com/files/162140/PrestaShop-1.7.6.7-SQL-Injection.htmlunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://packetstormsecurity.com/files/162140/PrestaShop-1.7.6.7-SQL-Injection.htmlhttps://github.com/PrestaShop/PrestaShop/commit/3fa0dfa5a8f4b149c7c90b948a12b4f5999a5ef8https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.6.8https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-fghq-8h87-826g