PT-2018-18646 · Prestashop · Prestashop+1

Andrea Iodice · Publicado 2018-05-10 · Atualizado 2018-06-13 · CVE-2018-8824

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PrestaShop versions 1.5.5.0 through 1.7.2.5 Responsive Mega Menu (Horizontal+Vertical+Dropdown) Pro module version 1.0.32

Description The issue allows remote attackers to execute a SQL Injection through function calls in the code parameter of the ajax phpcode.php file in the Responsive Mega Menu module.

Recommendations For PrestaShop versions 1.5.5.0 through 1.7.2.5, consider disabling the ajax phpcode.php file in the Responsive Mega Menu (Horizontal+Vertical+Dropdown) Pro module until a patch is available. For the Responsive Mega Menu (Horizontal+Vertical+Dropdown) Pro module version 1.0.32, avoid using the code parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2018-8824

Produtos afetados

Prestashop

Responsive Mega Menu (Horizontal+Vertical+Dropdown) Pro

Referências · 4

• 🔥 https://ia-informatica.com/it/CVE-2018-8824 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8824 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-8824 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-8824 · Aviso do Fabricante