CVE-2023-30545CWE-89

PrestaShop arbitrary file read vulnerability

High · published April 25, 2023

CVSS v3.1
7.7
EPSS
1%
Percentile
58.2
In the wild
Unconfirmed
What it is

PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, it is possible for a user with access to the SQL Manager (Advanced Options -> Database) to arbitrarily read any file on the operating system when using SQL function `LOAD_FILE` in a `SELECT` request. This gives the user access to critical information. A patch is available in PrestaShop 8.0.4 and PS 1.7.8.9

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00863 · 58.2th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2023-04-25T17:47Z
EPSS history
Timeline
  • 25 APR 17:47Z
    PrestaShop arbitrary file read vulnerability
    cvelistv5