Critical severity · published Aug 1, 2022
CVE-2022-31181
Remote code execution in prestashop
9.8
CVSS
6.7%
EPSS
No
On KEV
Description
PrestaShop is an Open Source e-commerce platform. In versions from 1.6.0.10 and before 1.7.8.7 PrestaShop is subject to an SQL injection vulnerability which can be chained to call PHP's Eval function on attacker input. The problem is fixed in version 1.7.8.7. Users are advised to upgrade. Users unable to upgrade may delete the MySQL Smarty cache feature.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.7% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
PrestaShop · PrestaShop
>= 1.6.0.10, < 1.7.8.7 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-31181
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-31181
Patch
https://github.com/PrestaShop/PrestaShop/commit/b6d96e7c2a4e35a44e96ffbcdfd34439b56af804
Release Notes
https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.8.7
Mitigation
https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-hrgx-p36p-89q4
More from PrestaShop
9.9
CVE-2023-30838
PrestaShop is an Open Source e-commerce web application
9.8
CVE-2023-39526
PrestaShop is an open source e-commerce web application
9.8
CVE-2023-39524
PrestaShop is an open source e-commerce web application
9.8
CVE-2022-21686
PrestaShop is an Open Source e-commerce platform
9.8
CVE-2021-43789
PrestaShop is an Open Source e-commerce web application