CVE-2022-22897
Published: 29 August 2022
Summary
CVE-2022-22897 is a critical-severity SQL Injection (CWE-89) vulnerability in Apollotheme Ap Pagebuilder. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A SQL injection vulnerability tracked as CVE-2022-22897 exists in the product_all_one_img and image_product parameters of the ApolloTheme AP PageBuilder component through version 2.4.4 for PrestaShop. The flaw, assigned CWE-89, received a CVSS 3.1 score of 9.8 and permits direct manipulation of database queries through unsanitized input.
Unauthenticated remote attackers can supply crafted values to the affected parameters and exfiltrate arbitrary database contents without requiring authentication or user interaction. Successful exploitation can lead to full read access and, given the CVSS impact metrics, potential modification or deletion of data as well.
Public references including the Friends of Presta security advisory and Packet Storm exploit listings provide additional technical details and recommended actions for affected PrestaShop installations. The associated EPSS score stands at 0.9104 with an identical recorded peak.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-28031
Vulnerability details
A SQL injection vulnerability in the product_all_one_img and image_product parameters of the ApolloTheme AP PageBuilder component through 2.4.4 for PrestaShop allows unauthenticated attackers to exfiltrate database data.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.