CVE-2023-30839: 
PHP vulnerability analysis and mitigation

PrestaShop, an Open Source e-commerce web application, disclosed a critical SQL filtering vulnerability (CVE-2023-30839) affecting versions prior to 8.0.4 and 1.7.8.9. The vulnerability was discovered and disclosed on April 25, 2023, impacting the back-office functionality of PrestaShop installations (NVD, SecurityOnline).

The vulnerability received a critical CVSS v3.1 base score of 9.9, with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. It is classified as a SQL filtering bypass vulnerability that affects the database access controls. The flaw is specifically related to the executeS method in the database handling functionality, which failed to properly restrict non-select queries (GitHub Advisory, BleepingComputer).

The vulnerability allows any back-office user to write, update, and delete data in the database without having the necessary permissions. This could lead to unauthorized modifications to the online store's data, potentially causing significant damage or service outage to impacted businesses. The vulnerability affects nearly 300,000 online merchants worldwide who use PrestaShop (SecurityOnline, BleepingComputer).

The vulnerability has been patched in PrestaShop versions 8.0.4 and 1.7.8.9. There are no known workarounds for this vulnerability, making it crucial for website owners to upgrade to the patched versions as soon as possible (NVD, GitHub Advisory).