CVE-2023-39526 CRITICAL

CVE-2023-39526: PrestaShopSQL manager vulnerability (potential RCE)

Vendor Prestashop
Product PrestaShop
Weakness CWE-89 · SQLi
Published August 7, 2023
Last update October 10, 2024
View on NVD All CVEs

CVSS base score

9.1/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to remote code execution through SQL injection and arbitrary file write in the back office. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch. There are no known workarounds.

Key dates

02Disclosure timeline

August 7, 2023 CVE published
October 10, 2024 Record updated