PT-2020-14236 · Prestashop · Prestashop

R00Tpgp · Published 2020-09-24 · Updated 2021-05-05 · CVE-2020-15160

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PrestaShop versions 1.7.5.0 through 1.7.6.7

Description The issue concerns a blind SQL Injection attack in the Catalog Product edition page, specifically with the location parameter. This allows for unauthorized access to database information. The problem is fixed in version 1.7.6.8.

Recommendations For PrestaShop versions 1.7.5.0 through 1.7.6.7, update to version 1.7.6.8 to resolve the issue. As a temporary workaround, consider restricting access to the Catalog Product edition page until the update is applied.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-15160

GHSA-FGHQ-8H87-826G

Affected Products

Prestashop

References · 8

• 🔥 https://exploit-db.com/exploits/49755 · Exploit
• https://github.com/PrestaShop/PrestaShop/commit/3fa0dfa5a8f4b149c7c90b948a12b4f5999a5ef8 · Patch
• https://osv.dev/vulnerability/CVE-2020-15160 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15160 · Security Note
• https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.6.8 · Note
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-fghq-8h87-826g · Note
• http://packetstormsecurity.com/files/162140/PrestaShop-1.7.6.7-SQL-Injection.html · Note
• https://t.me/cvenotify/14076 · Telegram Post