CVE-2020-26248

EUVD-2021-0491
In the PrestaShop module "productcomments" before version 4.2.1, an attacker can use a Blind SQL injection to retrieve data or stop the MySQL service. The problem is fixed in 4.2.1 of the module.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.8 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
GitHub_MCNA
6.8 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 99%
Affected Products (NVD)
VendorProductVersion
prestashopproductcomments
𝑥
< 4.2.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://packetstormsecurity.com/files/160539/PrestaShop-ProductComments-4.2.0-SQL-Injection.html
https://github.com/PrestaShop/productcomments/commit/7c2033dd811744e021da8897c80d6c301cd45ffa
https://github.com/PrestaShop/productcomments/releases/tag/v4.2.1
https://github.com/PrestaShop/productcomments/security/advisories/GHSA-5v44-7647-xfw9
https://packagist.org/packages/prestashop/productcomments
http://packetstormsecurity.com/files/160539/PrestaShop-ProductComments-4.2.0-SQL-Injection.html
https://github.com/PrestaShop/productcomments/commit/7c2033dd811744e021da8897c80d6c301cd45ffa
https://github.com/PrestaShop/productcomments/releases/tag/v4.2.1
https://github.com/PrestaShop/productcomments/security/advisories/GHSA-5v44-7647-xfw9
https://packagist.org/packages/prestashop/productcomments