CVE-2023-39526: critical vulnerability in PrestaShop
PrestaShopSQL manager vulnerability (potential RCE)
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.1epss 1.7%
from disclosure to weapon3 days
Published on NVDAug 7
1st PoC+3d
PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to remote code execution through SQL injection and arbitrary file write in the back office. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch. There are no known workarounds.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected products
PrestaShop · PrestaShoppublic PoCs found — 1
githubgithub.com/dnkhack/fixcve2023_39526_2023_39527★ 3⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — PrestaShop
In the same product, most dangerous first.
CVE-2024-34716CRITICALPrestaShop vulnerable to XSS via customer contact form in FO, through file uploadEPSS 59.0%CVE-2020-15160—Blind SQL Injection in PrestaShopEPSS 10.8%CVE-2022-31181CRITICALRemote code execution in prestashopEPSS 7.7%CVE-2021-43789HIGHBlind SQLi using Search filters in PrestaShopEPSS 4.7%CVE-2021-21302MEDIUMCSV Injection via csv exportEPSS 2.4%CVE-2021-21308MEDIUMImproper session management for soft logoutEPSS 1.9%