CVE-2022-31181: critical vulnerability in PrestaShop
Remote code execution in prestashop
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
85Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 9.8epss 7.7%
from disclosure to weaponsame day
Published on NVDAug 1
1st PoCJul 26
VulnCheckJul 22
PrestaShop is an Open Source e-commerce platform. In versions from 1.6.0.10 and before 1.7.8.7 PrestaShop is subject to an SQL injection vulnerability which can be chained to call PHP's Eval function on attacker input. The problem is fixed in version 1.7.8.7. Users are advised to upgrade. Users unable to upgrade may delete the MySQL Smarty cache feature.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
PrestaShop · PrestaShoppublic PoCs found — 1
githubgithub.com/drkbcn/lblfixer_cve_2022_31181★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — PrestaShop
In the same product, most dangerous first.
CVE-2024-34716CRITICALPrestaShop vulnerable to XSS via customer contact form in FO, through file uploadEPSS 57.7%CVE-2020-15160—Blind SQL Injection in PrestaShopEPSS 10.8%CVE-2021-43789HIGHBlind SQLi using Search filters in PrestaShopEPSS 4.7%CVE-2021-21302MEDIUMCSV Injection via csv exportEPSS 2.4%CVE-2021-21308MEDIUMImproper session management for soft logoutEPSS 1.9%CVE-2022-21686CRITICALServer Side Twig Template Injection in PrestaShopEPSS 1.8%