It is possible for a user having access to the SQL Manager (Advanced Options -> Database) to arbitrary read any file on the Operating system when using SQL function LOAD_FILE in a SELECT request. So It can access to critical information.
This vulnerability affects the following application versions:
- PrestaShop 1.7.5.0
- PrestaShop 1.7.5.0 beta 1
- PrestaShop 1.7.5.0 RC 1
- PrestaShop 1.7.5.0-beta.1
- PrestaShop 1.7.5.0-RC.1
- PrestaShop 1.7.5.1
- PrestaShop 1.7.5.2
- PrestaShop 1.7.6.0
- PrestaShop 1.7.6.0 beta 1
- PrestaShop 1.7.6.0 RC 1
- PrestaShop 1.7.6.0 RC 2
- PrestaShop 1.7.6.0-beta.1
- PrestaShop 1.7.6.0-RC.1
- PrestaShop 1.7.6.0-RC.2
- PrestaShop 1.7.6.1
- PrestaShop 1.7.6.2
- PrestaShop 1.7.6.3
- PrestaShop 1.7.6.4
- PrestaShop 1.7.6.4 1
- PrestaShop 1.7.6.5
- PrestaShop 1.7.6.5 1
- PrestaShop 1.7.6.6
- PrestaShop 1.7.6.7
- PrestaShop 1.7.6.8
- PrestaShop 1.7.6.9
- PrestaShop 1.7.7.0
- PrestaShop 1.7.7.0 beta 1
- PrestaShop 1.7.7.0 beta 2
- PrestaShop 1.7.7.0 RC 1
- PrestaShop 1.7.7.0-beta.1
- PrestaShop 1.7.7.0-beta.2
- PrestaShop 1.7.7.0-RC.1
- PrestaShop 1.7.7.1
- PrestaShop 1.7.7.2
- PrestaShop 1.7.7.3
- PrestaShop 1.7.7.4
- PrestaShop 1.7.7.5
- PrestaShop 1.7.7.6
- PrestaShop 1.7.7.7
- PrestaShop 1.7.7.8
- PrestaShop 1.7.7.8 1
- PrestaShop 1.7.8.0
- PrestaShop 1.7.8.0 beta 1
- PrestaShop 1.7.8.0 1
- PrestaShop 1.7.8.0 RC 1
- PrestaShop 1.7.8.0-beta.1
- PrestaShop 1.7.8.0-RC.1
- PrestaShop 1.7.8.1
- PrestaShop 1.7.8.2
- PrestaShop 1.7.8.2 1
- PrestaShop 1.7.8.3
- PrestaShop 1.7.8.4
- PrestaShop 1.7.8.5
- PrestaShop 1.7.8.6
- PrestaShop 1.7.8.7
- PrestaShop 1.7.8.7 1
- PrestaShop 1.7.8.8
- PrestaShop 8.0.0
- PrestaShop 8.0.1
- PrestaShop 8.0.2
- PrestaShop 8.0.3