CVE-2023-30839: SQL filter bypass leading to arbitrary write requests using "SQL Manager"
Impact SQL filtering vulnerability, a BO user can write, update and delete in the database, even without having specific rights.
Patches PrestaShop 8.0.4 and 1.7.8.9 will contain the patch.
Workarounds no
References no
Other sources
PrestaShop is an Open Source e-commerce web application. Versions prior to 8.0.4 and 1.7.8.9 contain a SQL filtering vulnerability. A BO user can write, update, and delete in the database, even without having specific rights. PrestaShop 8.0.4 and 1.7.8.9 contain a patch for this issue. There are no known workarounds.
— MITRE
SQL filter bypass leading to arbitrary write requests using "SQL Manager"
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/prestashop/prestashopto a version that resolves this vulnerability.Fixed in 1.7.8.9 - Upgrade
Upgrade
composer/prestashop/prestashopto a version that resolves this vulnerability.Fixed in 8.0.4 - Upgrade
Upgrade
PrestaShopto a version that resolves this vulnerability.Fixed in 8.0.4
Event History
Frequently Asked Questions
What is CVE-2023-30839?
CVE-2023-30839 is a vulnerability in PrestaShop that allows a BO user to write, update, and delete in the database, even without having specific rights.
What is the severity of CVE-2023-30839?
CVE-2023-30839 has a severity rating of critical with a CVSS score of 8.8.
How does CVE-2023-30839 impact PrestaShop?
CVE-2023-30839 allows an attacker with Back Office (BO) user access to manipulate the database without proper authorization, potentially leading to unauthorized actions and data breaches.
Which versions of PrestaShop are affected by CVE-2023-30839?
Versions prior to 8.0.4 and 1.7.8.9 of PrestaShop are affected by CVE-2023-30839.
How can I fix CVE-2023-30839?
To fix CVE-2023-30839, update PrestaShop to version 8.0.4 or 1.7.8.9 that contain a patch for this vulnerability.