CVE-2020-26248

Katalog CVE

CVSS 8.2 · High EPSS 12,4%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada prestashop productcomments. Skor CVSS 3.1 8.2 (High) menurut NVD.

Deskripsi (NVD)

In the PrestaShop module "productcomments" before version 4.2.1, an attacker can use a Blind SQL injection to retrieve data or stop the MySQL service. The problem is fixed in 4.2.1 of the module.

Rincian

Terbit di NVD

3 Desember 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

12,4% peluang dieksploitasi; lebih tinggi dari 96,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/PrestaShop/productcomments/commit/7c2033dd811744e021da8897c80d6c301cd45ffa patch · advisory pihak ketiga
• http://packetstormsecurity.com/files/160539/PrestaShop-ProductComments-4.2.0-SQL-Injection.html exploit · advisory pihak ketiga · vdb entry
• https://github.com/PrestaShop/productcomments/releases/tag/v4.2.1 release notes · advisory pihak ketiga
• https://github.com/PrestaShop/productcomments/security/advisories/GHSA-5v44-7647-xfw9 advisory pihak ketiga
• https://packagist.org/packages/prestashop/productcomments release notes · advisory pihak ketiga