En resumen
- CVE-2023-30545 es una vulnerabilidad MEDIO (CVSS 6.5) que afecta a prestashop/prestashop, prestashop (prestashop).
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.86%, mayor que el 58.6% de las vulnerabilidades.
- Solución: actualizar a 8.0.4, 1.7.8.9 o posterior.
Description
Impact
It is possible for a user having access to the SQL Manager (Advanced Options -> Database) to arbitrary read any file on the Operating system when using SQL function LOAD_FILE in a SELECT request. So It can access to critical information.
Patches
The patch will be on PS 8.0.4 and PS 1.7.8.9
NVD description
PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, it is possible for a user with access to the SQL Manager (Advanced Options -> Database) to arbitrarily read any file on the operating system when using SQL function `LOAD_FILE` in a `SELECT` request. This gives the user access to critical information. A patch is available in PrestaShop 8.0.4 and PS 1.7.8.9
Más vulnerabilidades de prestashop/prestashop
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free