Headline

CVE-2023-33279: [CVE-2023-33279] Improper neutralization of multiple SQL parameters in the SC Fix My Prestashop module for PrestaShop

In the Store Commander scfixmyprestashop module through 2023-05-09 for PrestaShop, sensitive SQL calls can be executed with a trivial HTTP request and exploited to forge a blind SQL injection.

2 years ago

CVE

Open in Source

#sql #vulnerability #web #auth

In the module “SC Fix My Prestashop” (scfixmyprestashop), an anonymous user can perform a SQL injection. The module is obsolete and must be deleted.

Summary

CVE ID: CVE-2023-33279
Published at: 2023-05-25
Platform: PrestaShop
Product: scfixmyprestashop
Impacted release: ALL VERSIONS DANGER
Product author: Store Commander
Weakness: CWE-89
Severity: critical (9.8)

Description

In scfixmyprestashop module for PrestaShop (all versions, must be deleted as soon as possible), a sensitive SQL call can be executed with a trivial http call and exploited to forge a blind SQL injection.

CVSS base metrics

Attack vector: network
Attack complexity: low
Privilege required: none
User interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high

Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Possible malicious usage

Technical and personal data leaks
Obtain admin access
Remove all data of the linked PrestaShop
Display sensitives tables to front-office to unlock potential admin’s ajax scripts of modules protected by token on the ecosystem

Other recommandations

It’s recommended to delete the module
Upgrade PrestaShop to the latest version to disable multiquery executions (separated by “;”)
Change the default database prefix ps_ by a new longer arbitrary prefix. Nethertheless, be warned that this is useless against blackhat with DBA senior skill because of a design vulnerability in DBMS
Activate OWASP 942’s rules on your WAF (Web application firewall), be warned that you will probably break your backoffice and you will need to pre-configure some bypasses against these set of rules.

Timeline

Date

Action

2022-09-21

Issue discovered after a security audit by TouchWeb

2022-09-21

Contact Author

2023-05-15

Request a CVE ID

2023-05-22

Received CVE ID

Store Commander thanks TouchWeb for its courtesy and its help after the vulnerability disclosure.