Critical severity · published Aug 7, 2023
CVE-2023-39526
PrestaShop is an open source e-commerce web application
9.8
CVSS
1.7%
EPSS
No
On KEV
Description
PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to remote code execution through SQL injection and arbitrary file write in the back office. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch. There are no known workarounds.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
Prestashop · Prestashop
before 1.7.8.10; 8.0.0 before 8.0.5; 8.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-39526
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-39526
Patch
https://github.com/PrestaShop/PrestaShop/commit/817847e2347844a9b6add017581f1932bcd28c09
Vendor Advisory
https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-gf46-prm4-56pc
More from Prestashop
9.9
CVE-2023-30838
PrestaShop is an Open Source e-commerce web application
9.8
CVE-2024-34989
In the module RSI PDF/HTML catalog evolution (prestapdf) <= 7.0.0 from RSI for PrestaShop, a guest can perform SQL injection via…
9.8
CVE-2024-33276
SQL Injection vulnerability in FME Modules preorderandnotication v.3.1.0 and before allows a remote attacker to run arbitrary SQL commands via the…
9.8
CVE-2024-25845
In the module "CD Custom Fields 4 Orders" (cdcustomfields4orders) <= 1.0.0 from Cleanpresta.com for PrestaShop, a guest can perform SQL injection in affected versions
9.8
CVE-2023-39524
PrestaShop is an open source e-commerce web application