PT-2023-26997 · Unknown · Prestashop

Matthieu-Rolland · Publicado 2023-08-07 · Atualizado 2024-03-06 · CVE-2023-39526

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PrestaShop versions prior to 1.7.8.10 PrestaShop versions prior to 8.0.5 PrestaShop versions prior to 8.1.1

Description PrestaShop is an open source e-commerce web application. The issue concerns remote code execution through SQL injection and arbitrary file write in the back office. There are no known workarounds.

Recommendations For versions prior to 1.7.8.10, update to version 1.7.8.10 or later. For versions prior to 8.0.5, update to version 8.0.5 or later. For versions prior to 8.1.1, update to version 8.1.1 or later.

Exploit

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

BIT-PRESTASHOP-2023-39526

CVE-2023-39526

GHSA-GF46-PRM4-56PC

Produtos afetados

Prestashop

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39526.json · Exploit
• https://github.com/PrestaShop/PrestaShop · Nota
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-gf46-prm4-56pc · Aviso do Fabricante
• https://github.com/PrestaShop/PrestaShop/commit/817847e2347844a9b6add017581f1932bcd28c09 · Correção
• https://osv.dev/vulnerability/CVE-2023-39526 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-39526 · Nota de Segurança
• https://t.me/cvenotify/56164 · Publicação no Telegram
• https://osv.dev/vulnerability/BIT-prestashop-2023-39526 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-gf46-prm4-56pc · Aviso do Fabricante
• https://t.me/pentestingnews/38324 · Publicação no Telegram
• https://t.me/cvenotify/55964 · Publicação no Telegram
• https://twitter.com/Komodosec/status/1688996639485333507 · Publicação no Twitter
• https://t.me/cibsecurity/67923 · Publicação no Telegram