| Package | Affected versions | Patched versions |
|---|---|---|
| prestashop/prestashop | ≥ 8.0.0, < 8.0.4< 1.7.8.9 | 8.0.41.7.8.9 |
| prestashop | ≥ 8.0.0, < 8.0.4< 1.7.8.9 | 8.0.41.7.8.9 |
It is possible for a user having access to the SQL Manager (Advanced Options -> Database) to arbitrary read any file on the Operating system when using SQL function LOAD_FILE in a SELECT request. So It can access to critical information.
The patch will be on PS 8.0.4 and PS 1.7.8.9
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free