Skip to content

Arbitrary file read

High
mflasquin published GHSA-8r4m-5p6p-52rp Apr 25, 2023

Package

composer prestashop/prestashop (Composer)

Affected versions

< 8.0.3

Patched versions

8.0.4 and 1.7.8.9

Description

Impact

It is possible for a user having access to the SQL Manager (Advanced Options -> Database) to arbitrary read any file on the Operating system when using SQL function LOAD_FILE in a SELECT request. So It can access to critical information.

Patches

The patch will be on PS 8.0.4 and PS 1.7.8.9

Severity

High
7.7
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CVE ID

CVE-2023-30545

Weaknesses

No CWEs

Credits