PT-2023-26997 · Unknown · Prestashop

Matthieu-Rolland · Published 2023-08-07 · Updated 2024-03-06 · CVE-2023-39526

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PrestaShop versions prior to 1.7.8.10 PrestaShop versions prior to 8.0.5 PrestaShop versions prior to 8.1.1

Description PrestaShop is an open source e-commerce web application. The issue concerns remote code execution through SQL injection and arbitrary file write in the back office. There are no known workarounds.

Recommendations For versions prior to 1.7.8.10, update to version 1.7.8.10 or later. For versions prior to 8.0.5, update to version 8.0.5 or later. For versions prior to 8.1.1, update to version 8.1.1 or later.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BIT-PRESTASHOP-2023-39526

CVE-2023-39526

GHSA-GF46-PRM4-56PC

Affected Products

Prestashop

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39526.json · Exploit
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-gf46-prm4-56pc · Vendor Advisory
• https://github.com/PrestaShop/PrestaShop/commit/817847e2347844a9b6add017581f1932bcd28c09 · Patch
• https://osv.dev/vulnerability/CVE-2023-39526 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39526 · Security Note
• https://osv.dev/vulnerability/BIT-prestashop-2023-39526 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gf46-prm4-56pc · Vendor Advisory
• https://github.com/PrestaShop/PrestaShop · Note
• https://t.me/cvenotify/56164 · Telegram Post
• https://t.me/pentestingnews/38324 · Telegram Post
• https://t.me/cvenotify/55964 · Telegram Post
• https://twitter.com/Komodosec/status/1688996639485333507 · Twitter Post
• https://t.me/cibsecurity/67923 · Telegram Post