CVE-2021-3110: 
Prestashop vulnerability analysis and mitigation

The vulnerability (CVE-2021-3110) affects PrestaShop version 1.7.7.0, an open-source e-commerce solution. The vulnerability was discovered and disclosed on January 7, 2021, and involves a time-based boolean SQL injection vulnerability in the store system (CVE Details, NVD).

The vulnerability exists in the store system's product comments module, specifically in the CommentGrade controller when processing the id_products[] parameter. It is classified as a time-based SQL injection vulnerability (CWE-89: Improper Neutralization of Special Elements used in an SQL Command). The CVSS v3.1 base score is 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability allows attackers to perform time-based boolean SQL injection attacks against the affected PrestaShop installation. This could potentially lead to unauthorized access to the database, data theft, and manipulation of database contents (Medium Blog).

A proof-of-concept exploit has been published demonstrating the vulnerability. The exploit involves sending a specially crafted request to the CommentGrade controller with a malicious SQL payload that induces time delays in the server response (Exploit DB, Medium Blog).

Several mitigation strategies are recommended: 1) Use prepared statements, 2) Implement stored procedures, 3) Apply whitelisting characters, and 4) Configure the application database with least privilege principles (Medium Blog).