PT-2023-26995 · Unknown · Prestashop

Aleksey Solovev · Published 2023-08-07 · Updated 2024-03-06 · CVE-2023-39524

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions PrestaShop versions prior to 8.1.1

Description PrestaShop is an open source e-commerce web application. SQL injection is possible in the product search field, in the Back Office's product page.

Recommendations For PrestaShop versions prior to 8.1.1, update to version 8.1.1 to resolve the issue. As a temporary workaround, consider restricting access to the product search field in the Back Office's product page until the patch is applied.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BIT-PRESTASHOP-2023-39524

CVE-2023-39524

GHSA-75P5-JWX4-QW9H

Affected Products

Prestashop

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39524.json · Exploit
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-75p5-jwx4-qw9h · Vendor Advisory
• https://github.com/PrestaShop/PrestaShop/commit/2047d4c053043102bc46a37d383b392704bf14d7 · Patch
• https://osv.dev/vulnerability/BIT-prestashop-2023-39524 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-39524 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39524 · Security Note
• https://osv.dev/vulnerability/GHSA-75p5-jwx4-qw9h · Vendor Advisory
• https://github.com/PrestaShop/PrestaShop · Note
• https://t.me/cvenotify/55955 · Telegram Post
• https://t.me/cibsecurity/67932 · Telegram Post