CVE-2023-30191
📋 TL;DR
This vulnerability allows attackers to execute arbitrary SQL commands on PrestaShop installations using the cdesigner module version 3.1.9 or earlier. Attackers can potentially access, modify, or delete database content. Any PrestaShop site with the vulnerable cdesigner module installed is affected.
💻 Affected Systems
- PrestaShop cdesigner module
📦 What is this software?
Cdesigner by Cdesigner Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to remote code execution.
Likely Case
Unauthorized database access allowing extraction of sensitive information like customer data, admin credentials, or payment information.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only allowing data viewing without modification.
🎯 Exploit Status
SQL injection via CdesignerTraitementModuleFrontController::initContent() method allows direct exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.9
Vendor Advisory: https://friends-of-presta.github.io/security-advisories/modules/2023/05/17/cdesigner-89.html
Restart Required: No
Instructions:
1. Log into PrestaShop admin panel. 2. Navigate to Modules > Module Manager. 3. Find 'cdesigner' module. 4. Click 'Upgrade' to version 3.1.9 or later. 5. Clear PrestaShop cache.
🔧 Temporary Workarounds
Disable cdesigner module
allTemporarily disable the vulnerable module until patching is possible
php /path/to/prestashop/bin/console prestashop:module disable cdesigner
Web Application Firewall rule
allBlock SQL injection patterns targeting cdesigner endpoints
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries at application level
- Restrict database user permissions to minimum required privileges
🔍 How to Verify
Check if Vulnerable:
Check cdesigner module version in PrestaShop admin panel under Modules > Module ManagerCheck Version:
grep -r 'version' /path/to/prestashop/modules/cdesigner/ | grep -i '3.1'Verify Fix Applied:
Confirm cdesigner module version is 3.1.9 or higher in module manager📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple requests to cdesigner module endpoints with SQL syntax
Network Indicators:
- HTTP requests containing SQL keywords (SELECT, UNION, etc.) to cdesigner paths
SIEM Query:
source="web_logs" AND uri="*cdesigner*" AND (query="*SELECT*" OR query="*UNION*" OR query="*OR 1=1*")