Em resumo
- CVE-2023-30545 é uma vulnerabilidade MÉDIO (CVSS 6.5) que afeta prestashop/prestashop, prestashop (prestashop).
- Chance de exploração nos próximos 30 dias (EPSS): 0.86%, maior que 58.6% das vulnerabilidades.
- Correção: atualize para 8.0.4, 1.7.8.9 ou posterior.
Description
Impact
It is possible for a user having access to the SQL Manager (Advanced Options -> Database) to arbitrary read any file on the Operating system when using SQL function LOAD_FILE in a SELECT request. So It can access to critical information.
Patches
The patch will be on PS 8.0.4 and PS 1.7.8.9
NVD description
PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, it is possible for a user with access to the SQL Manager (Advanced Options -> Database) to arbitrarily read any file on the operating system when using SQL function `LOAD_FILE` in a `SELECT` request. This gives the user access to critical information. A patch is available in PrestaShop 8.0.4 and PS 1.7.8.9
Mais vulnerabilidades de prestashop/prestashop
Ver tudo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free