Vulnerability: PrestaShop from version 1.7.5.0 and before version 1.7.6.8 is vulnerable to a blind SQL Injection attack in the Catalog Product edition page with location parameter. The problem is fixed in 1.7.6.8
Vulnerability ID: CVE-2020-15160
CWE: CWE-89
Severity score: 6.4
Project: https://github.com/PrestaShop/PrestaShop
Published: 2020-09-24
File: classes/stock/StockAvailable.php
Commit message: Merge pull request from GHSA-fghq-8h87-826g

Escape location and ids when setting location
Commit author: GoT

Vulnerable version (before fix):
 public static function setLocation($id_product, $location, $id_shop = null, $id_         if ($existing_id > 0) {             Db::getInstance()->update(                 'stock_available',                 array('location' => $location),                 'id_product = ' . $id_product .                 (($id_product_attribute) ? ' AND id_product_attribute = ' . $id_product_attribute : '') .                 StockAvailable::addSqlShopRestriction(null, $id_shop)             );         } else {             $params = array(                 'location' => $location,                 'id_product' => $id_product,                 'id_product_attribute' => $id_product_attribute,             );              StockAvailable::addSqlShopParams($params, $id_shop);             Db::getInstance()->insert('stock_available', $params, false, true, Db::ON_DUPLICATE_KEY);

Fixed version (after fix):
 public static function setLocation($id_product, $location, $id_shop = null, $id_         if ($existing_id > 0) {             Db::getInstance()->update(                 'stock_available',                 ['location' => pSQL($location)],                 'id_product = ' . (int) $id_product .                 (($id_product_attribute) ? ' AND id_product_attribute = ' . (int) $id_product_attribute : '') .                 StockAvailable::addSqlShopRestriction(null, $id_shop)             );         } else {             $params = [                 'location' => pSQL($location),                 'id_product' => (int) $id_product,                 'id_product_attribute' => (int) $id_product_attribute,             ];              StockAvailable::addSqlShopParams($params, $id_shop);             Db::getInstance()->insert('stock_available', $params, false, true, Db::ON_DUPLICATE_KEY);

Patch:
patch: @@ -395,17 +395,17 @@ public static function setLocation($id_product, $location, $id_shop = null, $id_
         if ($existing_id > 0) {
             Db::getInstance()->update(
                 'stock_available',
-                array('location' => $location),
-                'id_product = ' . $id_product .
-                (($id_product_attribute) ? ' AND id_product_attribute = ' . $id_product_attribute : '') .
+                ['location' => pSQL($location)],
+                'id_product = ' . (int) $id_product .
+                (($id_product_attribute) ? ' AND id_product_attribute = ' . (int) $id_product_attribute : '') .
                 StockAvailable::addSqlShopRestriction(null, $id_shop)
             );
         } else {
-            $params = array(
-                'location' => $location,
-                'id_product' => $id_product,
-                'id_product_attribute' => $id_product_attribute,
-            );
+            $params = [
+                'location' => pSQL($location),
+                'id_product' => (int) $id_product,
+                'id_product_attribute' => (int) $id_product_attribute,
+            ];
 
             StockAvailable::addSqlShopParams($params, $id_shop);
             Db::getInstance()->insert('stock_available', $params, false, true, Db::ON_DUPLICATE_KEY);
path: classes/stock/StockAvailable.php