CVE-2022-31101 PoC — SQL Injection in prestashop/blockwishlist

Source

https://github.com/karthikuj/CVE-2022-31101

Associated Vulnerability

Title:SQL Injection in prestashop/blockwishlist (CVE-2022-31101)
Description:prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can perform SQL injection. This issue is fixed in version 2.1.1. Users are advised to upgrade. There are no known workarounds for this issue.

Description

Exploit for PrestaShop bockwishlist module 2.1.0 SQLi (CVE-2022-31101)

Readme

# CVE-2022-31101
Exploit for PrestaShop bockwishlist module 2.1.0 SQLi (CVE-2022-31101)


## Usage
- `python3 cve-2022-31101.py`
- Give the url to the wishlist when prompted. Example of a url: `http://example.com/module/blockwishlist/view?id_wishlist=1`
- Give the cookies for your account when prompted.
- Now it will start attacking the website.

## In action
![cve-2022-31101](https://user-images.githubusercontent.com/59091280/183629068-cbd9ffad-c3cf-4a5e-9571-5d8d5becbe3d.png)

### Note
This exploit assumes the prefix for the table names in the database to be `ps_`. It is the default prefix given by PrestaShop.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!