CVE-2023-39526
CriticalCVSS 9.1Exploitation Probability (EPSS)
Elevated risk68th percentile - higher than 68% of all known CVEs
Summary
PrestaShop is an open source e-commerce application that is vulnerable to remote code execution through SQL injection and arbitrary file write in the back office in versions prior to 1.7.8.10, 8.0.5, and 8.1.1.
Risk Assessment
Exploitation of this vulnerability may lead to system takeover and unauthorized access to data. Organizations should be aware of the risks associated with outdated software versions.
Recommendation
It is recommended to upgrade to versions 1.7.8.10, 8.0.5, or 8.1.1, which contain patches addressing this vulnerability. A security audit of the system should also be conducted.
Original NVD description (English source)
PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to remote code execution through SQL injection and arbitrary file write in the back office. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch. There are no known workarounds.