Critical severity · published Aug 1, 2022
CVE-2022-31181
Remote code execution in prestashop
9.8
CVSS
6.7%
EPSS
No
On KEV
Description
PrestaShop is an Open Source e-commerce platform. In versions from 1.6.0.10 and before 1.7.8.7 PrestaShop is subject to an SQL injection vulnerability which can be chained to call PHP's Eval function on attacker input. The problem is fixed in version 1.7.8.7. Users are advised to upgrade. Users unable to upgrade may delete the MySQL Smarty cache feature.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.7% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
PrestaShop · PrestaShop
>= 1.6.0.10, < 1.7.8.7 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-31181
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-31181
Patch
https://github.com/PrestaShop/PrestaShop/commit/b6d96e7c2a4e35a44e96ffbcdfd34439b56af804
Release Notes
https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.8.7
Mitigation
https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-hrgx-p36p-89q4
More from PrestaShop
9.9
CVE-2023-30838
PrestaShop is an Open Source e-commerce web application
9.8
CVE-2024-34989
In the module RSI PDF/HTML catalog evolution (prestapdf) <= 7.0.0 from RSI for PrestaShop, a guest can perform SQL injection via…
9.8
CVE-2024-33276
SQL Injection vulnerability in FME Modules preorderandnotication v.3.1.0 and before allows a remote attacker to run arbitrary SQL commands via the…
9.8
CVE-2024-25845
In the module "CD Custom Fields 4 Orders" (cdcustomfields4orders) <= 1.0.0 from Cleanpresta.com for PrestaShop, a guest can perform SQL injection in affected versions
9.8
CVE-2023-39526
PrestaShopSQL manager vulnerability (potential RCE)