PT-2021-22957 · Prestashop · Customer Photo Gallery

Published 2021-09-08 · Updated 2021-09-15 · CVE-2021-40814

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Customer Photo Gallery addon versions prior to 2.9.4 for PrestaShop

Description The issue concerns SQL injection. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations For versions prior to 2.9.4, update to version 2.9.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the addon to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-40814

Affected Products

Customer Photo Gallery

References · 4

• https://osv.dev/vulnerability/CVE-2021-40814 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40814 · Security Note
• https://t.me/cibsecurity/28542 · Telegram Post
• https://getastra.com/blog/911/plugin-exploit/prestashops-customer-photo-gallery-module-vulnerable-to-sql-injection-attacks · Note