漏洞描述
PrestaShop Product Comments module before version 4.2.1 contains a SQL injection vulnerability, An attacker can use a blind SQL injection to retrieve data or stop the MySQL service, thereby possibly obtaining sensitive information, modifying data, and/or executing unauthorized administrative operations in the context of the affected site.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
packetstormsecurity.comhttps://packetstormsecurity.com/files/160539/PrestaShop-ProductComments-4.2.0-SQL-Injection.html↗packagist.orghttps://packagist.org/packages/prestashop/productcomments↗github.comhttps://github.com/PrestaShop/productcomments/security/advisories/GHSA-5v44-7647-xfw9↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2020-26248↗github.comhttps://github.com/PrestaShop/productcomments/commit/7c2033dd811744e021da8897c80d6c301cd45ffa↗