CVE-2022-31181
Published: 01 August 2022
Summary
CVE-2022-31181 is a critical-severity Injection (CWE-74) vulnerability in Prestashop Prestashop. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 1.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
PrestaShop, an open-source e-commerce platform, contains an SQL injection vulnerability in versions from 1.6.0.10 through 1.7.8.6 that can be chained to invoke PHP's eval function on attacker-supplied input. The flaw is tracked under CWE-74 and CWE-89 and carries a CVSS 3.1 base score of 9.8, reflecting network-accessible exploitation without authentication or user interaction.
An unauthenticated remote attacker can supply crafted input that triggers the injection, execute arbitrary SQL, and ultimately run PHP code on the server, resulting in full confidentiality, integrity, and availability impact on the affected installation.
The official PrestaShop security advisory and accompanying patches state that the issue is resolved in version 1.7.8.7; administrators unable to upgrade are advised to disable the MySQL Smarty cache feature as a temporary mitigation. The associated GitHub commits and release notes document the code changes that close the injection path.
EPSS for the CVE currently stands at 0.7827 with no material post-disclosure rise from a lower baseline.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-6354
Vulnerability details
PrestaShop is an Open Source e-commerce platform. In versions from 1.6.0.10 and before 1.7.8.7 PrestaShop is subject to an SQL injection vulnerability which can be chained to call PHP's Eval function on attacker input. The problem is fixed in version…
more
1.7.8.7. Users are advised to upgrade. Users unable to upgrade may delete the MySQL Smarty cache feature.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.
Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.
Validates query inputs to prevent SQL syntax or command manipulation.
Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.