9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-39526

CVE-2023-39526: PrestaShop SQL manager vulnerability

Impact

Remote code execution through SQL injection and arbitrary file write in back office

Patches

1.7.8.10 8.0.5 8.1.1

Found by

Truff (via yeswehack)

Workarounds

none

References

none

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-39526

CVE-2023-39526:

9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
prestashop/prestashop	composer	= 8.1.0	8.1.1
prestashop/prestashop	composer	>= 8.0.0, < 8.0.5	8.0.5
prestashop/prestashop	composer	< 1.7.8.10	1.7.8.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from insufficient validation in the SQL execution path. The critical patch modified Db::executeS in classes/db/Db.php to add checks for 'OUTFILE' and 'DUMPFILE' keywords, which are used for file operations in MySQL. Prior to the patch, executeS only validated the initial query type (e.g., SELECT) via regex but didn't inspect the full query for these dangerous clauses. This allowed SQL injection payloads containing 'INTO OUTFILE/DUMPFILE' to execute, enabling arbitrary file writes. The RequestSql.php change (adding keywords to a blocklist) reinforces this fix but the primary vulnerability resided in Db::executeS's lack of clause validation during query execution.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.