PT-2022-3994 · Unknown · Prestashop

Atomiix · Published 2022-07-29 · Updated 2025-10-11 · CVE-2022-31181

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PrestaShop versions 1.6.0.10 through 1.7.8.7

Description The issue is related to an SQL injection vulnerability in PrestaShop, an Open Source e-commerce platform. This vulnerability can be chained to call PHP's Eval function on attacker input, potentially allowing a remote attacker to execute arbitrary code. The problem is fixed in version 1.7.8.7.

Recommendations For PrestaShop versions 1.6.0.10 through 1.7.8.7, upgrade to version 1.7.8.7 to resolve the issue. For users unable to upgrade, delete the MySQL Smarty cache feature by removing the specified lines in the file config/smarty.config.inc.php to mitigate the risk. Specifically, remove lines 43-46 for PrestaShop 1.7 or lines 40-43 for PrestaShop 1.6.

Exploit

Fix

Eval Injection

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-95

CWE-74

CWE-89

Related Identifiers

BDU:2022-04827

CVE-2022-31181

GHSA-HRGX-P36P-89Q4

Affected Products

Prestashop

References · 11

• 🔥 https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-hrgx-p36p-89q4 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31181.json · Exploit
• https://github.com/PrestaShop/PrestaShop/commit/b6d96e7c2a4e35a44e96ffbcdfd34439b56af804 · Patch
• https://osv.dev/vulnerability/CVE-2022-31181 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31181 · Security Note
• https://bdu.fstec.ru/vul/2022-04827 · Security Note
• https://osv.dev/vulnerability/GHSA-hrgx-p36p-89q4 · Vendor Advisory
• https://github.com/PrestaShop/PrestaShop · Note
• https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.8.7 · Note
• https://t.me/cibsecurity/47383 · Telegram Post
• https://twitter.com/pdnuclei_bot/status/1977071740057743644 · Twitter Post