Main Vulnerability Database SB2022072568

SB2022072568 - Eval Injection in PrestaShop

Published: July 25, 2022 Updated: May 4, 2026

Security Bulletin ID SB2022072568

CSH Severity

High

Patch available

YES

Number of vulnerabilities 1

Exploitation vector Remote access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 1 vulnerability.

1) Eval Injection (CVE-ID: CVE-2022-31181)

CWE-ID: CWE-95 - Eval Injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in the MySQL Smarty cache feature when processing data influenced by an SQL injection. A remote attacker can exploit an SQL injection to inject code into dynamically evaluated content to execute arbitrary code.

Exploitation is possible only if the shop is also vulnerable to an SQL injection.

Remediation

Install update from vendor's website.

References

https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-hrgx-p36p-89q4