CVE-2022-31101
HIGH NUCLEIPrestaShop blockwishlist < 2.1.1 - Authenticated SQL Injection
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2022-31101. PoCs published by Karthik UJ, MathiasReker, karthikuj. A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit demonstrates a time-based SQL injection vulnerability in the Prestashop blockwishlist module 2.1.0. It extracts database information, including customer details, by leveraging a vulnerable parameter in the wishlist endpoint.
Description
prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can perform SQL injection. This issue is fixed in version 2.1.1. Users are advised to upgrade. There are no known workarounds for this issue.
Exploits (3)
This exploit demonstrates a time-based SQL injection vulnerability in the Prestashop blockwishlist module 2.1.0. It extracts database information, including customer details, by leveraging a vulnerable parameter in the wishlist endpoint.
This repository provides a scanner and remediation tool for CVE-2022-31101, a vulnerability in PrestaShop's MySQL Smarty cache storage. It detects and fixes code injection vulnerabilities and malware introduced via this exploit.
This is a functional SQL injection exploit for CVE-2022-31101, targeting the PrestaShop blockwishlist module 2.1.0. It uses time-based blind SQLi to extract database information, including customer details and password hashes.
Nuclei Templates (1)
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N