In breve
- CVE-2023-30545 è una vulnerabilità MEDIO (CVSS 6.5) che riguarda prestashop/prestashop, prestashop (prestashop).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.86%, superiore al 58.6% delle vulnerabilità.
- Correzione: aggiornare a 8.0.4, 1.7.8.9 o successiva.
Description
Impact
It is possible for a user having access to the SQL Manager (Advanced Options -> Database) to arbitrary read any file on the Operating system when using SQL function LOAD_FILE in a SELECT request. So It can access to critical information.
Patches
The patch will be on PS 8.0.4 and PS 1.7.8.9
NVD description
PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, it is possible for a user with access to the SQL Manager (Advanced Options -> Database) to arbitrarily read any file on the operating system when using SQL function `LOAD_FILE` in a `SELECT` request. This gives the user access to critical information. A patch is available in PrestaShop 8.0.4 and PS 1.7.8.9
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free