« Volver al listado

CVE-2020-15160

Estado: ModificadaCrítica (9.8)—💥 Exploit

PrestaShop a partir de la versión 1.7.5.0 y antes de la versión 1.7.6.8 es vulnerable a un ataque ciego de Inyección SQL en la página de edición del Catálogo de Productos con parámetro de localización. El problema se soluciona en la versión 1.7.6.8

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

💥 Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

Tecnologías afectadas (1)

Prestashop — Prestashop

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-15160",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "PrestaShop",
          "product": "PrestaShop",
          "versions": [
            {
              "status": "affected",
              "version": ">= 1.7.5.0, < 1.7.6.8"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-09-24T23:15:13.633",
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/162140/PrestaShop-1.7.6.7-SQL-Injection.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/PrestaShop/PrestaShop/commit/3fa0dfa5a8f4b149c7c90b948a12b4f5999a5ef8",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.6.8",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-fghq-8h87-826g",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "http://packetstormsecurity.com/files/162140/PrestaShop-1.7.6.7-SQL-Injection.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/PrestaShop/PrestaShop/commit/3fa0dfa5a8f4b149c7c90b948a12b4f5999a5ef8",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.6.8",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-fghq-8h87-826g",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "PrestaShop from version 1.7.5.0 and before version 1.7.6.8 is vulnerable to a blind SQL Injection attack in the Catalog Product edition page with location parameter. The problem is fixed in 1.7.6.8"
    },
    {
      "lang": "es",
      "value": "PrestaShop a partir de la versión 1.7.5.0 y antes de la versión 1.7.6.8 es vulnerable a un ataque ciego de Inyección SQL en la página de edición del Catálogo de Productos con parámetro de localización. El problema se soluciona en la versión 1.7.6.8"
    }
  ],
  "lastModified": "2026-06-17T02:56:10.223",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:prestashop:prestashop:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "40AB4A1B-150F-4C5E-944D-ECD6D725BEB5",
              "versionEndExcluding": "1.7.6.8",
              "versionStartIncluding": "1.7.5.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}