critical9.8Public exploit code
CVE-2018-19126
PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to execute arbitrary code via a file upload.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- PrestaShop 1.6.x/1.7.x - Remote Code Execution2018-12-11 · webapps · php
Impact
PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to execute arbitrary code via a file upload.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Prestashop | Prestashop | from 1.6.0.1 before 1.6.1.23 from 1.7.0.0 before 1.7.4.4 |
Weakness classification
References
- NVD record
- CVE.org record
- http://build.prestashop.com/news/prestashop-1-7-4-4-1-6-1-23-maintenance-releases/
- https://github.com/PrestaShop/PrestaShop/pull/11285
- https://github.com/PrestaShop/PrestaShop/pull/11286
- https://www.exploit-db.com/exploits/45964/
- http://build.prestashop.com/news/prestashop-1-7-4-4-1-6-1-23-maintenance-releases/
- https://github.com/PrestaShop/PrestaShop/pull/11285
- https://github.com/PrestaShop/PrestaShop/pull/11286
- https://www.exploit-db.com/exploits/45964/