CVE-2020-26248: 
PHP vulnerability analysis and mitigation

CVE-2020-26248 affects the PrestaShop module 'productcomments' versions before 4.2.1. The vulnerability was discovered and disclosed on December 3, 2020. The issue affects all versions from 4.0.0 up to (but not including) version 4.2.1 of the module (GitHub Advisory).

The vulnerability is classified as a Blind SQL injection vulnerability with a CVSS v3.1 Base Score of 8.2 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H). The issue is identified as CWE-89 (SQL Injection) and occurs during the CommentGrade process (NVD).

An attacker can exploit this vulnerability to retrieve data from the database or potentially cause a denial of service by stopping the MySQL service. The vulnerability allows unauthorized access to sensitive data and could potentially disrupt service availability (GitHub Advisory).

The vulnerability is easily exploitable as it requires no authentication or user interaction. The attack vector is network-accessible and can be executed with low attack complexity (NVD).

The vulnerability has been patched in version 4.2.1 of the productcomments module. Users are advised to upgrade to this version or later to mitigate the risk. The fix involves proper casting of IDs into integers to prevent SQL injection (GitHub Commit).