CVE-2022-31101 in the critical feed json
SQL Injection in prestashop/blockwishlist
published 2022-06-25 4 y ago modified 2026-06-17 4 mo ago also GHSA-2jx3-5j9v-prpp , EUVD-2022-5893
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 23.5%
- EPSS 23.5% chance of exploitation in 30 days, percentile 97%
- public exploits
- 1
- Exploit-DB, plus a Nuclei check
Summary
prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can perform SQL injection. This issue is fixed in version 2.1.1. Users are advised to upgrade. There are no known workarounds for this issue.
Patch / fix
- packagist prestashop/blockwishlist 2.1.1
- prestashop blockwishlist 2.1.1
Timeline
- Published
- First public exploit (EDB-51001)
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 18 mo ago
Exploit prediction
23.49% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-51001 Prestashop blockwishlist module 2.1.0 - SQLi webapps, 2022-08-09
- Nuclei template Prestashop Blockwishlist 2.1.0 SQL Injection nuclei detection template
- packetstormsecurity.com http://packetstormsecurity.com/files/168003/Prestashop-Blockwishlist-2.1.0-SQL-Injection.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
| GitHub | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | prestashop/blockwishlist | >=2.0.0, <2.1.1 |
2.1.1 |
Affected products
- PrestaShop blockwishlist
Classification
- Weakness
-
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
-
github.com
/PrestaShop/blockwishlist/commit/b3ec4b85af5fd73f74d55390b226d221298ca084
web, patch, third-party-advisory
-
packetstormsecurity.com
/files/168003/Prestashop-Blockwishlist-2.1.0-SQL-Injection.html
web, exploit, third-party-advisory, vdb-entry
-
github.com
/PrestaShop/blockwishlist/security/advisories/GHSA-2jx3-5j9v-prpp
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-31101
advisory
-
github.com
/PrestaShop/blockwishlist
package
Sources
- CVE List CVE-2022-31101
- GitHub Advisory GHSA-2jx3-5j9v-prpp
- NVD CVE-2022-31101
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.