CVE-2021-3110

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The store system in PrestaShop 1.7.7.0 allows time-based boolean SQL injection via the module=productcomments controller=CommentGrade id_products[] parameter.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://medium.com/%40gondaliyajaimin797/cve-2021-3110-75a24943ca5e
https://www.exploit-db.com/exploits/49410Exploit, Third Party Advisory, VDB Entry
https://medium.com/%40gondaliyajaimin797/cve-2021-3110-75a24943ca5e
https://www.exploit-db.com/exploits/49410Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Jan 20, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-31114.8The Express Entries Dashboard in Concrete5 8.5.4 allows stored XSS via the name field of a new data object at an index.php/dashboard/express CVE-2021-31137.5Netsia SEBA+ through 0.16.1 build 70-e669dcd7 allows remote attackers to discover session cookies via a direct /session/list/allActiveSessio CVE-2021-31146.5In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest CVE-2021-31157.5Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" c CVE-2021-311528.8Multilaser Router AC1200 V02.03.01.45_pt contains a cross-site request forgery (CSRF) vulnerability. An attacker can enable remote access, c CVE-2021-311533.3please before 0.4 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations CVE-2021-311547.8pleaseedit in please before 0.4 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain CVE-2021-311557.8Failure to normalize the umask in please before 0.4 allows a local attacker to gain full root privileges if they are allowed to execute at l CVE-2021-311567.5Allied Telesis AT-S115 1.2.0 devices before 1.00.024 with Boot Loader 1.00.006 allow Directory Traversal to achieve partial access to data.CVE-2021-311586.5In the Query Engine in Couchbase Server 6.5.x and 6.6.x through 6.6.1, Common Table Expression queries were not correctly checking the user'CVE-2021-311595.3Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-message generation in the CVE-2021-31167.5before_upstream_connection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data be