Maxime Flasquin

3 exploits Active since Apr 2023
CVE-2023-30545 WRITEUP HIGH WRITEUP
PrestaShop < 1.7.8.9 and 8.0.0-8.0.4 - Authenticated Arbitrary File Read via SQL LOAD_FILE Function
PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, it is possible for a user with access to the SQL Manager (Advanced Options -> Database) to arbitrarily read any file on the operating system when using SQL function `LOAD_FILE` in a `SELECT` request. This gives the user access to critical information. A patch is available in PrestaShop 8.0.4 and PS 1.7.8.9
CVSS 7.7
CVE-2023-30545 WRITEUP HIGH WRITEUP
PrestaShop < 1.7.8.9 and 8.0.0-8.0.4 - Authenticated Arbitrary File Read via SQL LOAD_FILE Function
PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, it is possible for a user with access to the SQL Manager (Advanced Options -> Database) to arbitrarily read any file on the operating system when using SQL function `LOAD_FILE` in a `SELECT` request. This gives the user access to critical information. A patch is available in PrestaShop 8.0.4 and PS 1.7.8.9
CVSS 7.7
CVE-2023-43663 WRITEUP MEDIUM WRITEUP
PrestaShop < 8.1.2 - Improper Privilege Management via Module Disabling
PrestaShop is an Open Source e-commerce web application. In affected versions any module can be disabled or uninstalled from back office, even with low user right. This allows low privileged users to disable portions of a shops functionality. Commit `ce1f6708` addresses this issue and is included in version 8.1.2. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS 6.3