SQL injection - Code In prestashop/prestashop
Description
Arbitrary file read via SQL injection
Impact
It is possible for a user having access to the SQL Manager (Advanced Options -> Database) to arbitrary read any file on the Operating system when using SQL function LOAD_FILE in a SELECT request. So It can access to critical information.
Patches
The patch will be on PS 8.0.4 and PS 1.7.8.9
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 packagist | 8.0.4, 1.7.8.9 |
Aliases
1. 2. 3. 4. 5.
References
1. 2. 3.