CVE-2020-15160

🗓️ 24 Sep 2020 22:10:19Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 162 Views🌐 WEB

PrestaShop before 1.7.6.8 blind SQL Injection in Catalog Product edition page

Reporter	Title	Published	Views	Family All 9
0day.today	PrestaShop 1.7.6.7 - (location) Blind Sql Injection Exploit	9 Apr 202100:00	–	zdt
Circl	CVE-2020-15160	21 Sep 202106:42	–	circl
CNVD	PrestaShop SQL Injection Vulnerability	27 Sep 202000:00	–	cnvd
Cvelist	CVE-2020-15160 Blind SQL Injection in PrestaShop	24 Sep 202022:10	–	cvelist
Exploit DB	PrestaShop 1.7.6.7 - 'location' Blind Sql Injection	9 Apr 202100:00	–	exploitdb
NVD	CVE-2020-15160	24 Sep 202023:15	–	nvd
OpenVAS	PrestaShop 1.7.5.0 < 1.7.6.8 SQLi Vulnerability	29 Sep 202000:00	–	openvas
Packet Storm	PrestaShop 1.7.6.7 SQL Injection	9 Apr 202100:00	–	packetstorm
Prion	Sql injection	24 Sep 202023:15	–	prion

NVD

Vulners

Node

prestashop prestashopRange1.7.5.0–1.7.6.8

[
  {
    "product": "PrestaShop",
    "vendor": "PrestaShop",
    "versions": [
      {
        "status": "affected",
        "version": ">= 1.7.5.0, < 1.7.6.8"
      }
    ]
  }
]

Source	Link
github	www.github.com/PrestaShop/PrestaShop/commit/3fa0dfa5a8f4b149c7c90b948a12b4f5999a5ef8
github	www.github.com/PrestaShop/PrestaShop/security/advisories/GHSA-fghq-8h87-826g
packetstormsecurity	www.packetstormsecurity.com/files/162140/PrestaShop-1.7.6.7-SQL-Injection.html
github	www.github.com/PrestaShop/PrestaShop/releases/tag/1.7.6.8

Parameter	Position	Path	Description	CWE
form[step3][location]	request body	/<admin_path>/index.php/sell/catalog/products/11?<token>	Blind SQL injection vulnerability in the location field of the product edition form (step3 location) in PrestaShop 1.7.x.	CWE-89

21 Nov 2024 05:04Current

9.7High risk

Vulners AI Score9.7

CVSS 27.5

CVSS 3.19.8

EPSS0.18559

CWE-89