CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-43789 – Blind SQLi using Search filters in PrestaShop
https://notcve.org/view.php?id=CVE-2021-43789
PrestaShop is an Open Source e-commerce web application. Versions of PrestaShop prior to 1.7.8.2 are vulnerable to blind SQL injection using search filters with `orderBy` and `sortOrder` parameters. The problem is fixed in version 1.7.8.2. PrestaShop es una aplicación web de comercio electrónico de código abierto. Las versiones de PrestaShop anteriores a 1.7.8.2, son vulnerables a una inyección SQL ciega usando filtros de búsqueda con los parámetros "orderBy" y "sortOrder". • https://github.com/numanturle/CVE-2021-43789 https://github.com/PrestaShop/PrestaShop/issues/26623 https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.8.2 https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-6xxj-gcjq-wgf4 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21398 – Possible XSS injection through DataColumn Grid class
https://notcve.org/view.php?id=CVE-2021-21398
PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.7.3, an attacker can inject HTML when the Grid Column Type DataColumn is badly used. The problem is fixed in 1.7.7.3 PrestaShop es una solución de comercio electrónico de código abierto totalmente escalable. En PrestaShop versiones anteriores a 1.7.7.3, un atacante puede inyectar HTML cuando el Grid Column Type DataColumn es usada incorrectamente. El problema se soluciona en la versión 1.7.7.3 • https://github.com/PrestaShop/PrestaShop/commit/aaaba8177f3b3c510461b5e3249e30e60f900205 https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.7.3 https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-fhhq-4x46-qx77 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21308 – Improper session management for soft logout
https://notcve.org/view.php?id=CVE-2021-21308
PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 the soft logout system is not complete and an attacker is able to foreign request and executes customer commands. The problem is fixed in 1.7.7.2 PrestaShop es una solución de comercio electrónico de código abierto totalmente escalable. En PrestaShop versiones anteriores a 1.7.2, el sistema de cierre de sesión suave no está completo y un atacante puede realizar peticiones externas y ejecutar comandos del cliente. El problema es corregido en versión 1.7.7.2 • https://github.com/PrestaShop/PrestaShop/commit/2f673bd93e313f08c35e74decc105f40dc0b7dee https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.7.2 https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-557h-hf3c-whcg • CWE-287: Improper Authentication •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21302 – CSV Injection via csv export
https://notcve.org/view.php?id=CVE-2021-21302
PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 there is a CSV Injection vulnerability possible by using shop search keywords via the admin panel. The problem is fixed in 1.7.7.2 PrestaShop es una solución de comercio electrónico de código abierto totalmente escalable. En PrestaShop versiones anteriores a 1.7.2, se presenta una posible vulnerabilidad de inyección de CSV al usar de palabras clave de búsqueda de la tienda por medio del panel de administración. El problema es corregido en versión 1.7.7.2 • https://github.com/PrestaShop/PrestaShop/commit/782b1368aa4e94dafe28f57485bffbd8893fbb1e https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.7.2 https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-2rw4-2p99-cmx9 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-1236: Improper Neutralization of Formula Elements in a CSV File •
CVSS: 9.8EPSS: 83%CPEs: 1EXPL: 1CVE-2021-3110
https://notcve.org/view.php?id=CVE-2021-3110
The store system in PrestaShop 1.7.7.0 allows time-based boolean SQL injection via the module=productcomments controller=CommentGrade id_products[] parameter. El sistema de tienda en PrestaShop versión 1.7.7.0, permite una inyección SQL booleana basada en el tiempo por medio del parámetro id_products[] de module=productcomments controller=CommentGrade • https://medium.com/%40gondaliyajaimin797/cve-2021-3110-75a24943ca5e https://www.exploit-db.com/exploits/49410 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •