PT-2018-18646 · Prestashop · Prestashop+1

Andrea Iodice · Published 2018-05-10 · Updated 2018-06-13 · CVE-2018-8824

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PrestaShop versions 1.5.5.0 through 1.7.2.5 Responsive Mega Menu (Horizontal+Vertical+Dropdown) Pro module version 1.0.32

Description The issue allows remote attackers to execute a SQL Injection through function calls in the code parameter of the ajax phpcode.php file in the Responsive Mega Menu module.

Recommendations For PrestaShop versions 1.5.5.0 through 1.7.2.5, consider disabling the ajax phpcode.php file in the Responsive Mega Menu (Horizontal+Vertical+Dropdown) Pro module until a patch is available. For the Responsive Mega Menu (Horizontal+Vertical+Dropdown) Pro module version 1.0.32, avoid using the code parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-8824

Affected Products

Prestashop

Responsive Mega Menu (Horizontal+Vertical+Dropdown) Pro

References · 4

• 🔥 https://ia-informatica.com/it/CVE-2018-8824 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-8824 · Security Note
• https://osv.dev/vulnerability/CVE-2018-8824 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8824 · Note