CVE-2023-39524

PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, SQL injection possible in the product search field, in BO's product page. Version 8.1.1 contains a patch for this issue. There are no known workarounds.

Published: Aug 7, 2023
Updated: May 10, 2024
CVE: CVE-2023-39524
GHSA: GHSA-75p5-jwx4-qw9h
Severity: Critical
Exploit:

CVSS v3:

Severity: Critical
Score: 9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWEs:

CWE-89

OWASP TOP 10:

A1 - Injection

Affected Software
References

Software	From	Fixed in
prestashop / prestashop	-	8.1.1
prestashop / prestashop	-	8.1.1

https://github.com/PrestaShop/PrestaShop/commit/2047d4c053043102bc46a37d383b392704bf14d7
https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-75p5-jwx4-qw9h

Vulnerability Database

CVE-2023-39524