CVE-2023-30545

Katalog CVE

CVSS 6.5 · Medium EPSS 0,86%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada prestashop. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, it is possible for a user with access to the SQL Manager (Advanced Options -> Database) to arbitrarily read any file on the operating system when using SQL function `LOAD_FILE` in a `SELECT` request. This gives the user access to critical information. A patch is available in PrestaShop 8.0.4 and PS 1.7.8.9

Rincian

Terbit di NVD

25 April 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

0,86% peluang dieksploitasi; lebih tinggi dari 57,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-8r4m-5p6p-52rp advisory vendor
• https://github.com/PrestaShop/PrestaShop/commit/cddac4198a47c602878a787280d813f60c6c0630 patch
• https://github.com/PrestaShop/PrestaShop/commit/d900806e1841a31f26ff0a1843a6888fc1bb7f81 patch