CVE-2023-26858
📋 TL;DR
This CVE describes a critical SQL injection vulnerability in the PrestaShop FAQs module v3.1.6, allowing remote attackers to execute arbitrary SQL commands via the faqsBudgetModuleFrontController::displayAjaxGenerateBudget component. Exploitation can lead to privilege escalation, data theft, or full system compromise. Users of PrestaShop with this specific module version are affected.
💻 Affected Systems
- PrestaShop FAQs module
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full administrative takeover of the PrestaShop instance, leading to data exfiltration, site defacement, or deployment of malware.
Likely Case
Unauthorized access to sensitive database information, such as user credentials or payment data, and potential privilege escalation.
If Mitigated
Limited impact if SQL injection protections like input validation or WAFs are in place, but risk remains if the vulnerability is unpatched.
🎯 Exploit Status
SQL injection vulnerabilities are often easy to exploit with automated tools, but no public proof-of-concept has been confirmed for this specific CVE.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor for updated version (likely v3.1.7 or higher)
Vendor Advisory: https://friends-of-presta.github.io/security-advisories/modules/2023/03/28/faqs.html
Restart Required: No
Instructions:
1. Log into PrestaShop admin panel. 2. Navigate to Modules > Module Manager. 3. Find the FAQs module and update to the latest patched version. 4. Verify the update completes successfully.
🔧 Temporary Workarounds
Disable the FAQs module
allTemporarily disable the vulnerable module to prevent exploitation until a patch is applied.
In PrestaShop admin, go to Modules > Module Manager, find FAQs module, and click Disable.
Implement WAF rules
allConfigure a web application firewall to block SQL injection attempts targeting the faqsBudgetModuleFrontController component.
Add custom WAF rule to detect and block SQL patterns in requests to /modules/faqs/controllers/front/displayAjaxGenerateBudget.
🧯 If You Can't Patch
- Restrict network access to the PrestaShop instance using firewalls to limit exposure to trusted IPs only.
- Monitor logs for unusual SQL queries or access attempts to the vulnerable component and implement alerting.
🔍 How to Verify
Check if Vulnerable:
Check the module version in PrestaShop admin under Modules > Module Manager for FAQs module; if version is 3.1.6, it is vulnerable.Check Version:
In PrestaShop, navigate to Modules > Module Manager and view the version of the FAQs module.Verify Fix Applied:
After updating, confirm the FAQs module version is no longer 3.1.6 and test the displayAjaxGenerateBudget endpoint for SQL injection attempts.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in PrestaShop logs, especially related to faqsBudgetModuleFrontController::displayAjaxGenerateBudget.
Network Indicators:
- HTTP requests containing SQL injection patterns (e.g., UNION SELECT, OR 1=1) targeting the vulnerable endpoint.
SIEM Query:
Example: search 'faqsBudgetModuleFrontController' AND ('SQL' OR 'error') in web server logs.🔗 References
- https://addons.prestashop.com/en/faq-frequently-asked-questions/16036-frequently-asked-questions-faq-page.html
- https://friends-of-presta.github.io/security-advisories/modules/2023/03/28/faqs.html
- https://addons.prestashop.com/en/faq-frequently-asked-questions/16036-frequently-asked-questions-faq-page.html
- https://friends-of-presta.github.io/security-advisories/modules/2023/03/28/faqs.html
