CVE-2021-43789: SQL injection in prestashop/prestashop
Impact Blind SQLi using Search filters with orderBy and sortOrder parameters
Patches The problem is fixed in 1.7.8.2
Other sources
PrestaShop is an Open Source e-commerce web application. Versions of PrestaShop prior to 1.7.8.2 are vulnerable to blind SQL injection using search filters with orderBy and sortOrder parameters. The problem is fixed in version 1.7.8.2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/prestashop/prestashopto a version that resolves this vulnerability.Fixed in 1.7.8.2 - Upgrade
Upgrade
prestashop/prestashopto a version that resolves this vulnerability.Fixed in 1.7.8.2
Event History
Frequently Asked Questions
What is the vulnerability ID for this PrestaShop vulnerability?
The vulnerability is identified as CVE-2021-43789.
What is the severity of CVE-2021-43789?
The severity of CVE-2021-43789 is critical with a CVSS score of 9.8.
How does CVE-2021-43789 affect PrestaShop?
Versions of PrestaShop prior to 1.7.8.2 are vulnerable to blind SQL injection using search filters.
How can I fix CVE-2021-43789?
To fix CVE-2021-43789, update your PrestaShop installation to version 1.7.8.2 or later.
Is there any additional information available about CVE-2021-43789?
Additional information about CVE-2021-43789 can be found on the PrestaShop GitHub page and the PrestaShop security advisories page.