UpHeron
All vulnerabilities

Servers and applications

CVE-2023-39526

SQL manager vulnerability (potential RCE)

Severity
Critical 9.8
Published
7 Aug 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.7.8.10, 8.0.5
Also known as
GHSA-gf46-prm4-56pc
Sources
NVD, Project advisories (GitHub)

Description

PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to remote code execution through SQL injection and arbitrary file write in the back office. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch. There are no known workarounds.

Affected software

SoftwareAffected versions
PrestaShopServers and applications · cpe:a:prestashop:prestashop
  • Every version before 1.7.8.10
  • From 8.0.0 before 8.0.5
  • Version 8.1.0
PrestaShopServers and applications · github:prestashop/prestashop
  • Every version before 1.7.8.10

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-39526
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-39526
  • GitHub Advisory Database https://github.com/advisories/GHSA-gf46-prm4-56pc
  • github.com https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-gf46-prm4-56pc