CVE-2022-31101

prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can perform SQL injection. This issue is fixed in version 2.1.1. Users are advised to upgrade. There are no known workarounds for this issue.
Configurations

Configuration 1 (hide)

cpe:2.3:a:prestashop:blockwishlist:*:*:*:*:*:*:*:*

History

21 Nov 2024, 07:03

Type Values Removed Values Added
CVSS v2 : 6.5
v3 : 8.8
v2 : 6.5
v3 : 8.1
References () http://packetstormsecurity.com/files/168003/Prestashop-Blockwishlist-2.1.0-SQL-Injection.html - Exploit, Third Party Advisory, VDB Entry () http://packetstormsecurity.com/files/168003/Prestashop-Blockwishlist-2.1.0-SQL-Injection.html - Exploit, Third Party Advisory, VDB Entry
References () https://github.com/PrestaShop/blockwishlist/commit/b3ec4b85af5fd73f74d55390b226d221298ca084 - Patch, Third Party Advisory () https://github.com/PrestaShop/blockwishlist/commit/b3ec4b85af5fd73f74d55390b226d221298ca084 - Patch, Third Party Advisory
References () https://github.com/PrestaShop/blockwishlist/security/advisories/GHSA-2jx3-5j9v-prpp - Third Party Advisory () https://github.com/PrestaShop/blockwishlist/security/advisories/GHSA-2jx3-5j9v-prpp - Third Party Advisory

10 Aug 2022, 20:15

Type Values Removed Values Added
References
  • (MISC) http://packetstormsecurity.com/files/168003/Prestashop-Blockwishlist-2.1.0-SQL-Injection.html -

06 Jul 2022, 19:33

Type Values Removed Values Added
CPE cpe:2.3:a:prestashop:blockwishlist:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown
v2 : 6.5
v3 : 8.8
References (MISC) https://github.com/PrestaShop/blockwishlist/commit/b3ec4b85af5fd73f74d55390b226d221298ca084 - (MISC) https://github.com/PrestaShop/blockwishlist/commit/b3ec4b85af5fd73f74d55390b226d221298ca084 - Patch, Third Party Advisory
References (CONFIRM) https://github.com/PrestaShop/blockwishlist/security/advisories/GHSA-2jx3-5j9v-prpp - (CONFIRM) https://github.com/PrestaShop/blockwishlist/security/advisories/GHSA-2jx3-5j9v-prpp - Third Party Advisory

27 Jun 2022, 23:15

Type Values Removed Values Added
New CVE

Information

Published : 2022-06-27 23:15

Updated : 2024-11-21 07:03


NVD link : CVE-2022-31101

Mitre link : CVE-2022-31101

CVE.ORG link : CVE-2022-31101


JSON object : View

Products Affected

prestashop

  • blockwishlist
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')