What is CVE-2023-39526?

CVE-2023-39526 is a critical-severity vulnerability in Prestashop, classified under SQL Injection. CVSS score: 9.1/10. Published 2023-08-07.

How severe is CVE-2023-39526?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Is CVE-2023-39526 known to be exploited?

3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

SQL Injection in Prestashop

CVE-2023-39526

PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to remote code execution through SQL injection and arbitrary file write in the back office. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch. There are no known workarounds.

Vulnerability class: SQL Injection

EPSS: 0.013 (68.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.

Affected products

Prestashop — versions = 8.1.0, < 1.7.8.10, >= 8.0.0, < 8.0.5

Weakness classification (CWE)

CWE-89 — SQL Injection

Public proof-of-concept exploits

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2023-39526?: CVE-2023-39526 is a critical-severity vulnerability in Prestashop, classified under SQL Injection. CVSS score: 9.1/10. Published 2023-08-07.
How severe is CVE-2023-39526?: Critical severity. CVSS v3 base score is 9.1 out of 10.
Is CVE-2023-39526 known to be exploited?: 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.