What’s Vulnerable › Vulnerabilities

CVE-2020-15160: Blind SQL Injection in PrestaShop

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 10.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-09-24 · updated 2026-06-17
• Weakness: CWE-89

Description

PrestaShop from version 1.7.5.0 and before version 1.7.6.8 is vulnerable to a blind SQL Injection attack in the Catalog Product edition page with location parameter. The problem is fixed in 1.7.6.8

Affected products

• PrestaShop: from 1.7.5.0 before 1.7.6.8 — fixed in 1.7.6.8

How to fix

Upgrade to a fixed version: PrestaShop 1.7.6.8. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/162140/PrestaShop-1.7.6.7-SQL-Injection.html
• https://github.com/PrestaShop/PrestaShop/commit/3fa0dfa5a8f4b149c7c90b948a12b4f5999a5ef8
• https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.6.8
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-fghq-8h87-826g
• http://packetstormsecurity.com/files/162140/PrestaShop-1.7.6.7-SQL-Injection.html
• https://github.com/PrestaShop/PrestaShop/commit/3fa0dfa5a8f4b149c7c90b948a12b4f5999a5ef8
• https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.6.8
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-fghq-8h87-826g

Get alerted when CVE-2020-15160 or the next vulnerability affects your stack