github_osv/GHSA-hrgx-p36p-89q4
PrestaShop eval injection possible if shop vulnerable to SQL injection
### Impact
Eval injection possible if the shop is vulnerable to an SQL injection.
### Patches
The problem is fixed in version 1.7.8.7
### Workarounds
Delete the MySQL Smarty cache feature by removing these lines in the file `config/smarty.config.inc.php` lines 43-46 (PrestaShop 1.7) or 40-43 (PrestaShop 1.6):
```php
if (Configuration::get('PS_SMARTY_CACHING_TYPE') == 'mysql') {
include _PS_CLASS_DIR_.'Smarty/SmartyCacheResourceMysql.php';
$smarty->caching_type = 'mysql';
}
```
gitlab/packagist/prestashop/prestashop/GMS-2022-3270
PrestaShop eval injection possible if shop vulnerable to SQL injection
### Impact
Eval injection possible if the shop is vulnerable to an SQL injection.
### Patches
The problem is fixed in version 1.7.8.7
### Workarounds
Delete the MySQL Smarty cache feature by removing these lines in the file `config/smarty.config.inc.php` lines 43-46 (PrestaShop 1.7) or 40-43 (PrestaShop 1.6):
```php
if (Configuration::get('PS_SMARTY_CACHING_TYPE') == 'mysql') {
include _PS_CLASS_DIR_.'Smarty/SmartyCacheResourceMysql.php';
$smarty->caching_type = 'mysql';
}
```