CVE-2023-39526: Critical SQL injection in PrestaShop
With the rapid growth of e-commerce and online transactions, a seamless shopping experience has become a necessity for businesses around the world. For many merchants, PrestaShop has been the platform of choice, earning the reputation as the leading open-source e-commerce solution in Europe and Latin America. However, the landscape of online security is ever-changing, and even the most robust platforms can find themselves prey to vulnerabilities.
Recently, a number of critical security vulnerabilities have been identified in PrestaShop that could have a significant impact on nearly 300,000 online merchants worldwide. These vulnerabilities could allow hackers to gain unauthorized access to PrestaShop stores, steal sensitive data, or even take control of the entire website.
The Critical Point: SQL Manager Vulnerability (CVE-2023-39526)
One of the most severe vulnerabilities is an SQL manager flaw, holding a CVSS score of 9.1. It grants any back-office user the ability to write, update, or even delete SQL databases, regardless of their permissions. Imagine a situation where sales representatives or data entry staff, with minimal authority, could accidentally (or intentionally) modify essential databases. The chaos that could ensue is not hard to picture.
Successful exploitation of the CVE-2023-39526 flaw could enable an attacker to submit a specially crafted request that grants the ability to execute arbitrary instructions, in this case, inject a fake payment form on the checkout page to gather credit card information. Remote code execution is possible.
File Deletion and Reading through Various Methods
- File Deletion via Attachment API (CVE-2023-39529): This vulnerability lets attackers delete a file from the server using specific controls.
- File Deletion via CustomerMessage (CVE-2023-39530): Similar to the above, files can be deleted through a particular API.
- Reading a File through Path Traversal (CVE-2023-39528): A display method can be exploited to read any file on the server, potentially even outside of the project if the server configuration is flawed.
Path Traversal and Injection Threats
- Path Traversal: File Deletion (CVE-2023-39525): Files can be compromised using path traversal by replaying specific queries.
- New Possible XSS Injection (CVE-2023-39527): A specific method can lead to XSS injection.
- Boolean SQL Injection (CVE-2023-39524): This vulnerability makes SQL injection possible in the product search field on BO’s product page.
The vulnerabilities affect versions <= 8.1.0 of PrestaShop. However, patches are available for versions 1.7.8.10, 8.1.1, and 8.0.5.
These are just a few of the most serious PrestaShop security vulnerabilities. It is important to keep your PrestaShop store up to date with the latest security patches to protect yourself from these attacks.
How to Protect Yourself from PrestaShop Security Vulnerabilities
There are a number of things you can do to protect your PrestaShop store from security vulnerabilities:
- Keep your PrestaShop store up to date with the latest security patches. PrestaShop releases security patches on a regular basis. It is important to install these patches as soon as possible to protect yourself from the latest vulnerabilities.
- Use a security scanner to scan your PrestaShop store for vulnerabilities. There are a number of security scanners available that can scan your PrestaShop store for vulnerabilities. This can help you identify and fix any potential security issues before they are exploited by hackers.
- Use strong passwords and security settings. Make sure you use strong passwords for your PrestaShop store and its administrative panel. You should also use strong security settings, such as two-factor authentication, to protect your store.
- Be aware of the latest security threats. It is important to stay up-to-date on the latest security threats that affect PrestaShop. This will help you identify and mitigate any potential risks to your store.
