CVE-2022-31181

Remote code execution in prestashop

9.8 CriticalPublic exploitFix available

PrestaShop is an Open Source e-commerce platform. In versions from 1.6.0.10 and before 1.7.8.7 PrestaShop is subject to an SQL injection vulnerability which can be chained to call PHP's Eval function on attacker input. The problem is fixed in version 1.7.8.7. Users are advised to upgrade. Users unable to upgrade may delete the MySQL Smarty cache feature.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

6.66%Up 5.8 points since Aug 2, 2022

What each source reports

CVE List Score used 9.8

Remote code execution in prestashop

Record: CVE-2022-31181
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-89, CWE-74
Updated: 2026-11-02

EUVDEUVD-2022-6354 9.8

Record: EUVD-2022-6354
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-hrgx-p36p-89q4 9.8

PrestaShop eval injection possible if shop vulnerable to SQL injection

Impact

Eval injection possible if the shop is vulnerable to an SQL injection.

Patches

The problem is fixed in version 1.7.8.7

Workarounds

Delete the MySQL Smarty cache feature by removing these lines in the file config/smarty.config.inc.php lines 43-46 (PrestaShop 1.7) or 40-43 (PrestaShop 1.6):

if (Configuration::get('PS_SMARTY_CACHING_TYPE') == 'mysql') {
    include _PS_CLASS_DIR_.'Smarty/SmartyCacheResourceMysql.php';
    $smarty->caching_type = 'mysql';
}

Record: GHSA-hrgx-p36p-89q4
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-89, CWE-95
Updated: 2026-11-02

NVD 9.8

Record: CVE-2022-31181
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-74, CWE-89
Updated: 2026-11-02

OSV 9.8

Remote code execution in prestashop

Record: CVE-2022-31181
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-74, CWE-89
Updated: 2026-11-02

OSVGHSA-hrgx-p36p-89q4 9.8

PrestaShop eval injection possible if shop vulnerable to SQL injection

Impact

Eval injection possible if the shop is vulnerable to an SQL injection.

Patches

The problem is fixed in version 1.7.8.7

Workarounds

Delete the MySQL Smarty cache feature by removing these lines in the file config/smarty.config.inc.php lines 43-46 (PrestaShop 1.7) or 40-43 (PrestaShop 1.6):

if (Configuration::get('PS_SMARTY_CACHING_TYPE') == 'mysql') {
    include _PS_CLASS_DIR_.'Smarty/SmartyCacheResourceMysql.php';
    $smarty->caching_type = 'mysql';
}

Record: GHSA-hrgx-p36p-89q4
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-89, CWE-95
Updated: 2026-11-02

Affected products

prestashop

Affected packages

Affected packages
Package	Affected	Fixed
`prestashop/prestashop` Packagist	1.6.0.10 up to 1.7.8.7	1.7.8.7
`prestashop/prestashop` Packagist	1.6.0.10 up to 1.7.8.7, plus listed versions 1.7.0.01.7.0.0-beta.1.01.7.0.0-beta.2.01.7.0.0-beta.3.01.7.0.0-beta.4.0 Show 45 moreShow less 1.7.0.0-rc.0.01.7.0.0-rc.1.01.7.0.0-rc.2.01.7.0.11.7.0.21.7.0.31.7.0.41.7.0.51.7.0.61.7.1.01.7.1.11.7.1.21.7.2.01.7.2.0-rc.1.01.7.2.11.7.2.21.7.2.31.7.2.41.7.2.51.7.3.01.7.3.11.7.3.21.7.3.31.7.3.41.7.4.01.7.4.0-beta.11.7.4.11.7.4.21.7.4.31.7.4.41.7.5.01.7.5.0-beta.11.7.5.0-rc.11.7.5.11.7.5.21.7.6.01.7.6.0-beta.11.7.6.0-rc.11.7.6.0-rc.21.7.6.11.7.6.21.7.6.31.7.6.41.7.6.51.7.6.6	1.7.8.7

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Nuclei	PrestaShop - SQL Injection to Eval Injection
PoC in GitHub	drkbcn/lblfixer_cve_2022_31181	2022-07-26

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-31181 is a critical vulnerability (CVSS 9.8) in Prestashop, published July 29, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 6.66%, the 93rd percentile. Fixed in prestashop/prestashop 1.7.8.7.

References

This page doesn't list everything

Left out here: 24 versions. The JSON record has them.