Remote code execution in prestashop
85Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 9.8epss 6.5%
from disclosure to weapon0 days
Published on NVDAug 1
1st PoCJul 26
VulnCheckJul 22
exploitation probability
6.5%top 7% of all CVEs
observed exploitation
yesVulnCheck
1 public exploit(s)
PrestaShop is an Open Source e-commerce platform. In versions from 1.6.0.10 and before 1.7.8.7 PrestaShop is subject to an SQL injection vulnerability which can be chained to call PHP's Eval function on attacker input. The problem is fixed in version 1.7.8.7. Users are advised to upgrade. Users unable to upgrade may delete the MySQL Smarty cache feature.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
PrestaShop · PrestaShoppublic PoCs found — 1
githubgithub.com/drkbcn/lblfixer_cve_2022_31181★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.