CVE-2022-31101 in the critical feed json
SQL Injection in prestashop/blockwishlist
published 4y ago modified 4mo ago also GHSA-2jx3-5j9v-prpp , EUVD-2022-5893
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 23.5%
- EPSS 23.5% chance of exploitation in 30 days, percentile 97%
- public exploits
- 1
- Exploit-DB, plus a Nuclei check
Summary
prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can perform SQL injection. This issue is fixed in version 2.1.1. Users are advised to upgrade. There are no known workarounds for this issue.
Patch / fix
- packagist prestashop/blockwishlist 2.1.1
- prestashop blockwishlist 2.1.1
Is CVE-2022-31101 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerTimeline
- Published
- First public exploit (EDB-51001)
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- last yr.
Exploit prediction
23.49% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- EDB-51001 Prestashop blockwishlist module 2.1.0 - SQLi webapps, 2022-08-09
- Nuclei template Prestashop Blockwishlist 2.1.0 SQL Injection nuclei detection template
- packetstormsecurity.com http://packetstormsecurity.com/files/168003/Prestashop-Blockwishlist-2.1.0-SQL-Injection.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
| GitHub | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | prestashop/blockwishlist | >=2.0.0, <2.1.1 |
2.1.1 |
Affected products
- PrestaShop blockwishlist
Classification
- Weakness
-
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
-
github.com
/PrestaShop/blockwishlist/commit/b3ec4b85af5fd73f74d55390b226d221298ca084
web, patch, third-party-advisory
-
packetstormsecurity.com
/files/168003/Prestashop-Blockwishlist-2.1.0-SQL-Injection.html
web, exploit, third-party-advisory, vdb-entry
-
github.com
/PrestaShop/blockwishlist/security/advisories/GHSA-2jx3-5j9v-prpp
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-31101
advisory
-
github.com
/PrestaShop/blockwishlist
package
Sources
- CVE List CVE-2022-31101
- GitHub Advisory GHSA-2jx3-5j9v-prpp
- NVD CVE-2022-31101
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.