{"id":"CVE-2023-30839","published":"2023-04-25T18:41:38Z","modified":"2025-02-03T18:08:09Z","title":"PrestaShop vulnerable to SQL filter bypass leading to arbitrary write requests using \"SQL Manager\"","vendor":"PrestaShop","product":"PrestaShop","tier":"tail","description":{"text":"PrestaShop is an Open Source e-commerce web application. Versions prior to 8.0.4 and 1.7.8.9 contain a SQL filtering vulnerability. A BO user can write, update, and delete in the database, even without having specific rights. PrestaShop 8.0.4 and 1.7.8.9 contain a patch for this issue. There are no known workarounds.","provenance":"source","from":"CVE.org"},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01706,"percentile":0.77262,"provenance":"source"},"cwes":[{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command"}],"references":[{"url":"https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-p379-cxqh-q822","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/PrestaShop/PrestaShop/commit/0f2a9b7fdd42d1dd3b21d4fad586a849642f3c30","tags":["x_refsource_MISC"]},{"url":"https://github.com/PrestaShop/PrestaShop/commit/d1d27dc371599713c912b71bc2a455cacd7f2149","tags":["x_refsource_MISC"]}],"priority":{"score":27.5,"factors":[{"name":"EPSS percentile","points":15.45},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":7.0}]},"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2023-04-27","earliestUrl":"https://github.com/drkbcn/lblfixer_cve_2023_30839","repos":[{"name":"drkbcn/lblfixer_cve_2023_30839","url":"https://github.com/drkbcn/lblfixer_cve_2023_30839","stars":0,"created":"2023-04-27"}]},"first":{"date":"2023-04-27","source":"PoC-in-GitHub","url":"https://github.com/drkbcn/lblfixer_cve_2023_30839"},"provenance":"source"},"vendorSlug":"prestashop","affectedVersions":[{"vendor":"PrestaShop","product":"PrestaShop","versions":[">= 8.0.0, < 8.0.4","< 1.7.8.9"]}],"affected":[{"ecosystem":"Packagist","package":"prestashop/prestashop","vulnerableRanges":[">=8.0.0, <8.0.4","<1.7.8.9"],"patched":["8.0.4","1.7.8.9"],"from":["GHSA-p379-cxqh-q822"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-1361","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-prestashop-cve-2023-30545","children":[{"from":"CVE-2023-30839","to":"CVE-2023-39526","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:prestashop/prestashop","fromFixed":"1.7.8.9","toFixed":"1.7.8.10","daysApart":104},{"kind":"version-step","provenance":"source","package":"Packagist:prestashop/prestashop","fromFixed":"8.0.4","toFixed":"8.0.5","daysApart":104},{"kind":"same-code","provenance":"machine","files":["classes/db/Db.php"],"commits":["https://github.com/PrestaShop/PrestaShop/commit/0f2a9b7fdd42d1dd3b21d4fad586a849642f3c30","https://github.com/PrestaShop/PrestaShop/commit/d1d27dc371599713c912b71bc2a455cacd7f2149","https://github.com/PrestaShop/PrestaShop/commit/817847e2347844a9b6add017581f1932bcd28c09"],"basis":"shared function","functions":["executeS"]},{"kind":"similar","provenance":"machine","score":0.44,"basis":"same product + CWE + description similarity"}]}],"packageHistory":[{"cve":"CVE-2022-46158","published":"2022-12-08","fixed":"1.7.8.8","kev":false,"link":{"from":"CVE-2022-46158","to":"CVE-2023-30839","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:prestashop/prestashop","fromFixed":"1.7.8.8","toFixed":"1.7.8.9","daysApart":138}]}},{"cve":"CVE-2023-25170","published":"2023-03-13","fixed":"8.0.1","kev":false,"link":{"from":"CVE-2023-25170","to":"CVE-2023-30839","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:prestashop/prestashop","fromFixed":"8.0.1","toFixed":"8.0.4","daysApart":43}]}},{"cve":"CVE-2023-30545","published":"2023-04-25","fixed":"8.0.4","kev":false},{"cve":"CVE-2023-30838","published":"2023-04-25","fixed":"8.0.4","kev":false},{"cve":"CVE-2023-30839","published":"2023-04-25","fixed":"8.0.4","kev":false},{"cve":"CVE-2023-39524","published":"2023-08-07","fixed":"8.1.1","kev":false},{"cve":"CVE-2023-39525","published":"2023-08-07","fixed":"8.1.1","kev":false},{"cve":"CVE-2023-39526","published":"2023-08-07","fixed":"8.1.1","kev":false},{"cve":"CVE-2023-39527","published":"2023-08-07","fixed":"8.1.1","kev":false,"link":{"from":"CVE-2023-30839","to":"CVE-2023-39527","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:prestashop/prestashop","fromFixed":"1.7.8.9","toFixed":"1.7.8.10","daysApart":104},{"kind":"version-step","provenance":"source","package":"Packagist:prestashop/prestashop","fromFixed":"8.0.4","toFixed":"8.0.5","daysApart":104}]}}],"package":"Packagist:prestashop/prestashop"}}