GHSA-8r4m-5p6p-52rpHighCVSS 7.7

Arbitrary file read via SQL injection

Published
April 26, 2023
Last Modified
November 11, 2023

🔗 CVE IDs covered (1)

CVE-2023-30545 →

📋 Description

Impact

It is possible for a user having access to the SQL Manager (Advanced Options -> Database) to arbitrary read any file on the Operating system when using SQL function LOAD_FILE in a SELECT request. So It can access to critical information.

Patches

The patch will be on PS 8.0.4 and PS 1.7.8.9

🎯 Affected products2

  • composer/prestashop/prestashop:>= 8.0.0, < 8.0.4
  • composer/prestashop/prestashop:< 1.7.8.9

🔗 References (5)