CVE-2023-30545: 
PHP vulnerability analysis and mitigation

PrestaShop, an Open Source e-commerce web application, disclosed a vulnerability (CVE-2023-30545) affecting versions prior to 8.0.4 and 1.7.8.9. The vulnerability was discovered and reported on April 25, 2023, allowing users with access to the SQL Manager to perform arbitrary file reads on the operating system (Vendor Advisory).

The vulnerability stems from the SQL Manager functionality (located in Advanced Options -> Database) where users could exploit the SQL function 'LOAD_FILE' in a 'SELECT' request to read arbitrary files on the operating system. The vulnerability has been assigned a CVSS v3.1 base score of 7.7 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, indicating network attack vector, low attack complexity, and high confidentiality impact (NVD, Vendor Advisory).

The vulnerability enables unauthorized access to critical information stored on the operating system. An attacker with access to the SQL Manager could potentially read sensitive files, including configuration files, system files, and other critical data stored on the server (Vendor Advisory).

The vulnerability has been patched in PrestaShop versions 8.0.4 and 1.7.8.9. Users are strongly advised to upgrade to these patched versions to protect against unauthorized file access. No alternative workarounds are available for this vulnerability (Vendor Advisory).