PrestaShop up to 1.6.1.22/1.7.4.3 access control

Summaryinfo

A vulnerability was found in PrestaShop up to 1.6.1.22/1.7.4.3. It has been classified as problematic. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in access control. This vulnerability is identified as CVE-2018-19125. The attack can be initiated remotely. Additionally, an exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic has been found in PrestaShop up to 1.6.1.22/1.7.4.3 (E-Commerce Management Software). This affects an unknown code block. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. This is going to have an impact on integrity, and availability. The summary by CVE is:

PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to delete an image directory.

The bug was discovered 11/07/2018. The weakness was released 11/09/2018 (Website). The advisory is shared at build.prestashop.com. This vulnerability is uniquely identified as CVE-2018-19125 since 11/09/2018. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are unknown but a public exploit is available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 2 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 1.6.1.23 or 1.7.4.4 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (45964). Entries connected to this vulnerability are available at VDB-126620 and VDB-126622. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• E-Commerce Management Software

Name

• PrestaShop

Version

• 1.6.1.0
• 1.6.1.1
• 1.6.1.2
• 1.6.1.3
• 1.6.1.4
• 1.6.1.5
• 1.6.1.6
• 1.6.1.7
• 1.6.1.8
• 1.6.1.9
• 1.6.1.10
• 1.6.1.11
• 1.6.1.12
• 1.6.1.13
• 1.6.1.14
• 1.6.1.15
• 1.6.1.16
• 1.6.1.17
• 1.6.1.18
• 1.6.1.19
• 1.6.1.20
• 1.6.1.21
• 1.6.1.22
• 1.7.4.0
• 1.7.4.1
• 1.7.4.2
• 1.7.4.3

License

• open-source

Website

• Product: https://github.com/PrestaShop/PrestaShop/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion