PT-2023-26995 · Unknown · Prestashop

Aleksey Solovev · Publicado 2023-08-07 · Atualizado 2024-03-06 · CVE-2023-39524

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions PrestaShop versions prior to 8.1.1

Description PrestaShop is an open source e-commerce web application. SQL injection is possible in the product search field, in the Back Office's product page.

Recommendations For PrestaShop versions prior to 8.1.1, update to version 8.1.1 to resolve the issue. As a temporary workaround, consider restricting access to the product search field in the Back Office's product page until the patch is applied.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

BIT-PRESTASHOP-2023-39524

CVE-2023-39524

GHSA-75P5-JWX4-QW9H

Produtos afetados

Prestashop

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39524.json · Exploit
• https://github.com/PrestaShop/PrestaShop · Nota
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-75p5-jwx4-qw9h · Aviso do Fabricante
• https://github.com/PrestaShop/PrestaShop/commit/2047d4c053043102bc46a37d383b392704bf14d7 · Correção
• https://t.me/cvenotify/55955 · Publicação no Telegram
• https://osv.dev/vulnerability/BIT-prestashop-2023-39524 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-39524 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-39524 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-75p5-jwx4-qw9h · Aviso do Fabricante
• https://t.me/cibsecurity/67932 · Publicação no Telegram