CVE-2021-43789: 
PHP vulnerability analysis and mitigation

PrestaShop, an Open Source e-commerce web application, versions prior to 1.7.8.2 were found to be vulnerable to blind SQL injection. The vulnerability (CVE-2021-43789) was discovered in the search filters functionality, specifically affecting the orderBy and sortOrder parameters. The issue was disclosed and patched in December 2021 with the release of version 1.7.8.2 (PrestaShop Advisory).

The vulnerability is classified as a High severity blind SQL injection vulnerability that affects the search filters functionality. The issue specifically involves the manipulation of orderBy and sortOrder parameters, which could allow an attacker to perform SQL injection attacks. The vulnerability has been assigned CWE-89 (SQL Injection) classification (PrestaShop Advisory).

The vulnerability could potentially allow attackers to perform blind SQL injection attacks through the search filters functionality. This type of vulnerability typically enables unauthorized access to or manipulation of the database, potentially compromising sensitive data or affecting the system's integrity (PrestaShop Advisory).

The vulnerability has been patched in PrestaShop version 1.7.8.2. Users are strongly advised to upgrade to this version or later to protect against this security issue. The fix was released on December 7, 2021, as part of a security patch release (PrestaShop Release).