CVE-2018-8823

CRITICALNuclei

PrestaShop Responsive Mega Menu Module - Remote Code Execution

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2018-8823 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

modules/bamegamenu/ajax_phpcode.php in the Responsive Mega Menu (Horizontal+Vertical+Dropdown) Pro module 1.0.32 for PrestaShop 1.5.5.0 through 1.7.2.5 allows remote attackers to execute arbitrary PHP code via the code parameter.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryCRITICALPrestaShop Responsive Mega Menu Module - Remote Code ExecutionCVSS 9.8

The 'Responsive Mega Menu' module for PrestaShop is prone to a remote code execution and SQL injection vulnerability. modules/bamegamenu/ajax_phpcode.php in the Responsive Mega Menu (Horizontal+Vertical+Dropdown) Pro module 1.0.32 for PrestaShop allows remote attackers to execute an SQL injection or remote code execution through function calls in the code parameter.

Impact

Unauthenticated attackers can execute arbitrary PHP code or SQL commands through the module, leading to complete PrestaShop compromise and access to customer data.

Remediation

Remove the vulnerable Responsive Mega Menu Pro module or upgrade to a patched version.

WeaknessesCWE-94
AuthorsMaStErChO
Template tagscvecve2018prestashoprcesqliresponsive_mega_menu_pro_projectvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:responsive_mega_menu_pro_project:responsive_mega_menu_pro:1.0.32:*:*:*:*:prestashop:*:*
Shodan: http.component:"prestashop"
https://vulners.com/openvas/OPENVAS:1361412562310144185 https://www.openservis.cz/prestashop-blog/nejcastejsi-utoky-v-roce-2023-seznam-deravych-modulu-nemate-nejaky-z-nich-na-e-shopu-i-vy/ https://github.com/advisories/GHSA-q937-6mg8-6rgc https://nvd.nist.gov/vuln/detail/CVE-2018-8823 https://github.com/zapalm/prestashop-security-vulnerability-checker

Source: ProjectDiscovery

References

2