High 7.5 CVSS 3.1 ph_simpleblog Published on 2021-08-20

A SQL Injection issue in the list controller of the Prestahome Blog (aka ph_simpleblog) module before 1.7.8 for Prestashop allows a remote attacker to extract…

CVECVE-2021-36748 GHSANo GHSA advisory

View at the source View JSON Last modified at the source: 2026-06-17

Description

A SQL Injection issue in the list controller of the Prestahome Blog (aka ph_simpleblog) module before 1.7.8 for Prestashop allows a remote attacker to extract data from the database via the sb_category parameter.

Original text by NVD (NIST), public domain.

CVSS metrics 3.1

Source: nvd@nist.gov · primary

High 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vectorNetwork

ComplexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityNone

AvailabilityNone

References

Productalysum5.promokit.eu
https://alysum5.promokit.eu/promokit/documentation/blog/
Productblog.sorcery.ie
https://blog.sorcery.ie
Exploitblog.sorcery.ie
https://blog.sorcery.ie/posts/ph_simpleblog_sqli/
Third Party Advisorysecurity.friendsofpresta.org
https://security.friendsofpresta.org/module/2021/08/20/ph_simpleblog.html

Found a vulnerability?

Write to the PrestaShop core security team:

security-core@prestashop.com

Do you use the ph_simpleblog module?

PrestaShield checks it from the outside, without FTP access, and alerts you of every new advisory that affects you.

Check if my shop is affected