Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-39525

CVE-2023-39525: PrestaShop path traversal

6.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-39525
GHSA ID
GHSA-m9r4-3fg7-pqm2
EPSS Score
0.73097%
CWE
CWE-22
Published
8/9/2023
Updated
11/12/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
prestashop/prestashopcomposer<= 8.1.08.1.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The commit diff shows the vulnerability stemmed from unsanitized $filename parameter usage in FileRemoval.php. The patch adds basename() to sanitize input, confirming the original function lacked path traversal protections. The CWE-22 classification and advisory descriptions directly match this pattern of unsanitized user input in file operations.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t In t** ***k o**i**, *il*s **n ** *ompromis** usin* p*t* tr*v*rs*l *y r*pl*yin* t** import *il* **l*tion qu*ry wit* * sp**i*i** *il* p*t*, usin* tr*v*rs*l p*t*. ### P*t***s *.*.* ### *oun* *y *l*ks*y Solov*v (Positiv* T***nolo*i*s) ### W

Reasoning

T** *ommit *i** s*ows t** vuln*r**ility st*mm** *rom uns*nitiz** `$*il*n*m*` p*r*m*t*r us*** in `*il*R*mov*l.p*p`. T** p*t** ***s `**s*n*m*()` to s*nitiz* input, *on*irmin* t** ori*in*l *un*tion l**k** p*t* tr*v*rs*l prot**tions. T** *W*-** *l*ssi*i*