Description
SQL injection through back-office list filters
Impact
This is an SQL injection issue in the back office.
The filter names used by back-office listings were not sufficiently validated before being used to build the corresponding database query. By sending a crafted filter name, a logged-in employee could make the shop run a query of their own choosing.
That allowed reading data from anywhere in the shop database, well beyond what their profile permits, including employee password hashes and the full customer and order tables. The reporter demonstrated it with the most restricted built-in profile, so the permission system did not contain the problem.
Patches
Upgrade to PrestaShop 9.1.5 or PrestaShop 8.2.8
The flawed code belongs to the legacy back-office controller and is also present in 1.7.x and earlier, which are end of life and will not receive a patch.
Workarounds
None
References
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command
- OWASP: SQL Injection Prevention Cheat Sheet
- Report a security issue: security-core@prestashop.com
_Credits: this vulnerability was discovered by Claude (Anthropic) as part of Anthropic's Coordinated Vulnerability Disclosure programme, verified by Doyensec, and responsibly reported to the PrestaShop security team by Savio (Doyensec). We thank them for their report and for coordinating the disclosure with us.
Original text by GitHub Security Advisory, licenseCC BY 4.0.
CVSS metrics 3.1
Source: github.com · secondaryCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:NReferences
Found a vulnerability?
Write to the PrestaShop core security team:
security-core@prestashop.com