{"id":"CVE-2022-31101","aliases":["EUVD-2022-5893","GHSA-2jx3-5j9v-prpp"],"status":"published","title":"SQL Injection in prestashop/blockwishlist","description":"prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can perform SQL injection. This issue is fixed in version 2.1.1. Users are advised to upgrade. There are no known workarounds for this issue.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.23492,"percentile":0.97812,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-89"],"published":"2022-06-25T07:11:45Z","modified":"2026-10-28T02:30:34Z","exploits":[{"source":"exploitdb","id":"EDB-51001","title":"Prestashop blockwishlist module 2.1.0 - SQLi","type":"webapps","platform":"php","date":"2022-08-09","url":"https://www.exploit-db.com/exploits/51001"},{"source":"nuclei","id":"CVE-2022-31101","title":"Prestashop Blockwishlist 2.1.0 SQL Injection","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31101.yaml"},{"source":"pocgithub","id":"MathiasReker/blmvuln","title":"MathiasReker/blmvuln","date":"2022-07-24","url":"https://github.com/MathiasReker/blmvuln"},{"source":"pocgithub","id":"karthikuj/CVE-2022-31101","title":"karthikuj/CVE-2022-31101","date":"2022-08-09","url":"https://github.com/karthikuj/CVE-2022-31101"}],"fixes":[{"ecosystem":"Packagist","package":"prestashop/blockwishlist","fixed_in":["2.1.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"prestashop/blockwishlist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.1.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"prestashop/blockwishlist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.1.1"}]}],"versions":["v2.0.0","v2.0.1","v2.1.0"]}],"products":[{"vendor":"prestashop","product":"blockwishlist"}],"references":[{"url":"https://github.com/PrestaShop/blockwishlist/security/advisories/GHSA-2jx3-5j9v-prpp","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/PrestaShop/blockwishlist/commit/b3ec4b85af5fd73f74d55390b226d221298ca084","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"http://packetstormsecurity.com/files/168003/Prestashop-Blockwishlist-2.1.0-SQL-Injection.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31101","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2jx3-5j9v-prpp"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31101.json","tags":["advisory"]},{"url":"https://github.com/PrestaShop/blockwishlist","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-31101","title":"SQL Injection in prestashop/blockwishlist","description":"prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can perform SQL injection. This issue is fixed in version 2.1.1. Users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2022-06-27T22:15:20Z","modified":"2025-04-22T17:53:16.914Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:34:35.279735Z"}],"euvd":[{"id":"EUVD-2022-5893","description":"prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can perform SQL injection. This issue is fixed in version 2.1.1. Users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2022-06-27T22:15:20Z","modified":"2025-04-22T17:53:16Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T20:52:15.540112Z"}],"ghsa":[{"id":"GHSA-2jx3-5j9v-prpp","title":"BlockWishList SQL Injection vulnerability","description":"### Impact\nAn authenticated customer can perform SQL injection\n\n### Patches\nIssue is fixed in 2.1.1\n","status":"published","published":"2022-06-25T07:11:45Z","modified":"2023-01-31T05:01:18Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:36:29.100018Z"}],"nvd":[{"id":"CVE-2022-31101","description":"prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can perform SQL injection. This issue is fixed in version 2.1.1. Users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2022-06-27T23:15:08.107Z","modified":"2026-06-17T04:44:47.967Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:07:22.966735Z"}],"osv":[{"id":"CVE-2022-31101","title":"SQL Injection in prestashop/blockwishlist","description":"prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can perform SQL injection. This issue is fixed in version 2.1.1. Users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2022-06-27T22:15:20Z","modified":"2026-10-28T02:30:34.695436555Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:44:25.516981Z"},{"id":"GHSA-2jx3-5j9v-prpp","title":"BlockWishList SQL Injection vulnerability","description":"### Impact\nAn authenticated customer can perform SQL injection\n\n### Patches\nIssue is fixed in 2.1.1\n","status":"published","published":"2022-06-25T07:11:45Z","modified":"2023-11-08T04:09:26.081999Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:34.338541Z"}]}}