CVE-2022-31181

CRITICALNuclei

Remote code execution in prestashop

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2022-31181 has a selected CVSS score of 9.8 (critical); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

PrestaShop is an Open Source e-commerce platform. In versions from 1.6.0.10 and before 1.7.8.7 PrestaShop is subject to an SQL injection vulnerability which can be chained to call PHP's Eval function on attacker input. The problem is fixed in version 1.7.8.7. Users are advised to upgrade. Users unable to upgrade may delete the MySQL Smarty cache feature.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jul 22, 2022 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
1
Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 23, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

PrestaShop

Browse PrestaShop / PrestaShop
CVE List, VulnCheck>= 1.6.0.10, < 1.7.8.7affected

prestashop/prestashop

Browse Packagist / prestashop/prestashop
GitHub Advisory1.6.0.10 to < 1.7.8.7 · Fixed in 1.7.8.7affected

Proofs of concept

1

Repository PoCs

GitHubdrkbcn/lblfixer_cve_2022_31181Repository PoCby drkbcn0Not analyzed99 files

323.8 KiB · linked to 2 vulnerabilities

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryCRITICALPrestaShop - SQL Injection to Eval InjectionCVSS 9.8

PrestaShop versions from 1.6.0.10 and before 1.7.8.7 contain an SQL injection caused by unsanitized user input, letting attackers chain the vulnerability to call PHP's Eval function, exploit requires attacker to send malicious input.

Impact

Attackers can execute arbitrary PHP code, leading to remote code execution and full system compromise

Remediation

Upgrade to version 1.7.8.7 or later. Alternatively, delete the MySQL Smarty cache feature if upgrade is not possible.

WeaknessesCWE-89CWE-74
Authorsdaffainfo
Template tagscvecve2022prestashoprceintrusivevkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:prestashop:prestashop:*:*:*:*:*:*:*:*
Shodan: http.component:"Prestashop"
Shodan: cpe:"cpe:2.3:a:prestashop:prestashop"
Shodan: http.component:"prestashop"
https://www.xmco.fr/wp-content/uploads/2022/12/XMCO-ActuSecu-59-Forwardshell-UXSS-cyberguerre.pdf https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-hrgx-p36p-89q4 https://github.com/PrestaShop/PrestaShop/commit/b6d96e7c2a4e35a44e96ffbcdfd34439b56af804 https://nvd.nist.gov/vuln/detail/CVE-2025-27007

Source: ProjectDiscovery

References

5