CVE-2022-31101
Published: 27 June 2022
Summary
CVE-2022-31101 is a high-severity SQL Injection (CWE-89) vulnerability in Prestashop Blockwishlist. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 1.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2022-31101 is a SQL injection vulnerability (CWE-89) affecting the PrestaShop blockwishlist module, an extension that provides wishlist functionality for customer accounts. The flaw exists in versions prior to 2.1.1 and stems from insufficient input sanitization on queries issued by authenticated users.
An attacker with a valid customer account can supply crafted input over the network to execute arbitrary SQL statements. Successful exploitation yields high impact on confidentiality and integrity, allowing the attacker to read or modify database contents, while availability remains unaffected.
The GitHub Security Advisory and associated commit indicate that the issue is resolved in blockwishlist 2.1.1; administrators are advised to upgrade immediately, as no workarounds are documented. Public proof-of-concept material has been posted to Packet Storm. The EPSS score stands at 0.57 with no material post-disclosure increase.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-5893
Vulnerability details
prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can perform SQL injection. This issue is fixed in version 2.1.1. Users are advised to upgrade. There are no known workarounds…
more
for this issue.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.