Blind SQL injection during the CommentGrade process

Summary

In the PrestaShop module "productcomments" before version 4.2.1, an attacker can use a Blind SQL injection to retrieve data or stop the MySQL service. The problem is fixed in 4.2.1 of the module.

Timeline

1. Dec 3, 2020, 8:55 PM UTCCVE published
2. Aug 4, 2024, 3:56 PM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• PrestaShop productcomments

  From 4.0.0 · fixed in 4.2.1

• prestashop/productcommentsPackagist

  From 4.0.0 · fixed in 4.2.1

References 6