CVE-2021-43789: Blind SQLi using Search filters in PrestaShop
First published: Tue Dec 07 2021(Updated: )
PrestaShop is an Open Source e-commerce web application. Versions of PrestaShop prior to 1.7.8.2 are vulnerable to blind SQL injection using search filters with `orderBy` and `sortOrder` parameters. The problem is fixed in version 1.7.8.2.
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Prestashop Prestashop | >=1.7.5.0<1.7.8.2 | |
| >=1.7.5.0<1.7.8.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this PrestaShop vulnerability?
The vulnerability is identified as CVE-2021-43789.
What is the severity of CVE-2021-43789?
The severity of CVE-2021-43789 is critical with a CVSS score of 9.8.
How does CVE-2021-43789 affect PrestaShop?
Versions of PrestaShop prior to 1.7.8.2 are vulnerable to blind SQL injection using search filters.
How can I fix CVE-2021-43789?
To fix CVE-2021-43789, update your PrestaShop installation to version 1.7.8.2 or later.
Is there any additional information available about CVE-2021-43789?
Additional information about CVE-2021-43789 can be found on the PrestaShop GitHub page and the PrestaShop security advisories page.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/references
- agent/weakness
- agent/title
- agent/first-publish-date
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/author
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/prestashop
- canonical/prestashop prestashop
- version/prestashop prestashop/1.7.5.0