CVE-2020-15160

EUVD-2020-7235
PrestaShop from version 1.7.5.0 and before version 1.7.6.8 is vulnerable to a blind SQL Injection attack in the Catalog Product edition page with location parameter. The problem is fixed in 1.7.6.8
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 94%
Affected Products (NVD)
VendorProductVersion
prestashopprestashop
1.7.5.0 ≤
𝑥
< 1.7.6.8
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://packetstormsecurity.com/files/162140/PrestaShop-1.7.6.7-SQL-Injection.html
https://github.com/PrestaShop/PrestaShop/commit/3fa0dfa5a8f4b149c7c90b948a12b4f5999a5ef8
https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.6.8
https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-fghq-8h87-826g
http://packetstormsecurity.com/files/162140/PrestaShop-1.7.6.7-SQL-Injection.html
https://github.com/PrestaShop/PrestaShop/commit/3fa0dfa5a8f4b149c7c90b948a12b4f5999a5ef8
https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.6.8
https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-fghq-8h87-826g