CVE-2022-22897: A SQL injection vulnerability in the product_all_one_img and image_product parameters of the ApolloTheme AP PageBuilder component through 2.4.4 for PrestaShop…

PriorityP184critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

ITWEXPLOITVulnCheck KEV

Exploited in the wild

EPSS

10.81%

95.3th percentile

A SQL injection vulnerability in the product_all_one_img and image_product parameters of the ApolloTheme AP PageBuilder component through 2.4.4 for PrestaShop allows unauthenticated attackers to exfiltrate database data.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
apollotheme	ap_pagebuilder	<= 2.4.5	—

Detection & IOCsextracted from sources · hover to see the quote

otherproduct_all_one_img↗

otherimage_product↗

→Monitor HTTP requests targeting AP PageBuilder component parameters 'product_all_one_img' and 'image_product' for SQL injection payloads; exploitation does not require authentication. ↗
→Detection rule targets PrestaShop AP PageBuilder version =6 with HTTP 200 response status and body content matching the component; use version comparison logic to flag vulnerable instances.

·The affected component version range spans AP PageBuilder through 2.4.4 (NVD) but the detection template also references version '=6', suggesting possible version discrepancy or multiple release branches; validate the exact version string present on target installations.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vulncheck9.8CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.