CVE-2023-27844
📋 TL;DR
This SQL injection vulnerability in PrestaShopleurlrewrite v1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the Dispatcher::getController component. Attackers can gain administrative privileges, access/modify database content, or potentially achieve remote code execution. All PrestaShop installations using the vulnerable leurlrewrite module are affected.
💻 Affected Systems
- PrestaShopleurlrewrite module
📦 What is this software?
Leurlrewrite by Litextension
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the PrestaShop installation including administrative access, database exfiltration/modification, and potential remote code execution leading to full system takeover.
Likely Case
Administrative privilege escalation allowing attackers to modify store content, access customer data, and install malicious modules.
If Mitigated
Limited impact if proper input validation and prepared statements are implemented, though SQL injection attempts may still cause service disruption.
🎯 Exploit Status
SQL injection vulnerabilities are commonly weaponized. The CVSS 9.8 score indicates trivial exploitation with high impact.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.0.1 or later
Vendor Advisory: https://friends-of-presta.github.io/security-advisories/modules/2023/04/13/leurlrewrite.html
Restart Required: No
Instructions:
1. Remove the vulnerable leurlrewrite module from your PrestaShop installation. 2. Install the patched version v1.0.1 or later from a trusted source. 3. Verify the module is properly updated in PrestaShop's module manager.
🔧 Temporary Workarounds
Disable leurlrewrite module
allTemporarily disable the vulnerable module to prevent exploitation while planning permanent fix.
Navigate to PrestaShop admin panel > Modules > Module Manager > Find leurlrewrite > Disable
Web Application Firewall (WAF) rules
allImplement WAF rules to block SQL injection patterns targeting the Dispatcher::getController component.
Configure WAF to block requests containing SQL injection patterns in URL parameters
🧯 If You Can't Patch
- Remove the leurlrewrite module completely from your PrestaShop installation
- Implement strict input validation and parameterized queries at the application level
🔍 How to Verify
Check if Vulnerable:
Check PrestaShop admin panel > Modules > Module Manager for leurlrewrite module version. If version is 1.0 or earlier, you are vulnerable.Check Version:
Check via PrestaShop admin interface: Modules > Module Manager > leurlrewrite detailsVerify Fix Applied:
Verify leurlrewrite module is either removed or updated to version 1.0.1 or later in the module manager.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by successful admin login
- Requests with SQL keywords in URL parameters
Network Indicators:
- HTTP requests containing SQL injection payloads targeting URL parameters
- Unusual traffic patterns to admin endpoints
SIEM Query:
web.url:*sql* OR web.url:*union* OR web.url:*select* AND web.url:*controller* AND destination.port:80 OR destination.port:443🔗 References
- https://friends-of-presta.github.io/security-advisories/modules/2023/04/13/leurlrewrite.html
- https://litextension.com/migration-services/seo-urls-migrations.html#page%232
- https://friends-of-presta.github.io/security-advisories/modules/2023/04/13/leurlrewrite.html
- https://litextension.com/migration-services/seo-urls-migrations.html#page%232
