Code Injection in PrestaShop - CVE-2018-19126

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in a file upload. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

How to mitigate CVE-2018-19126

Links to Public Exploits and PoC-codes

• Exploit #5973 - PrestaShop 1.6.x/1.7.x - Remote Code Execution (June 17, 2021)
• Exploit #3547 - PrestaShop-CVE-2018-19126 (PrestaShop (1.6.x <= 1.6.1.23 or 1.7.x <= 1.7.4.4) Back Office Remote Code Execution (CVE-2018-19126)) (July 20, 2020)

External References

• http://build.prestashop.com/news/prestashop-1-7-4-4-1-6-1-23-maintenance-releases/
• https://github.com/PrestaShop/PrestaShop/pull/11285
• https://github.com/PrestaShop/PrestaShop/pull/11286
• https://www.exploit-db.com/exploits/45964/

Related Security Bulletins

• Code Injection in PrestaShop