CVE-2023-30839
📋 TL;DR
This CVE describes a SQL injection vulnerability in PrestaShop e-commerce software that allows back-office users to perform unauthorized database operations. Users with back-office access can write, update, and delete database records without proper authorization checks. This affects PrestaShop versions prior to 8.0.4 and 1.7.8.9.
💻 Affected Systems
- PrestaShop
📦 What is this software?
Prestashop by Prestashop
Prestashop by Prestashop
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, privilege escalation, and potential remote code execution through database functions.
Likely Case
Unauthorized data manipulation, data exfiltration, and potential privilege escalation within the application.
If Mitigated
Limited impact if proper database permissions are enforced and user access is restricted, though SQL injection vectors remain.
🎯 Exploit Status
Exploitation requires back-office user credentials but no special privileges. SQL injection is a well-understood attack vector.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.0.4 or 1.7.8.9
Vendor Advisory: https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-p379-cxqh-q822
Restart Required: No
Instructions:
1. Backup your database and files. 2. Download PrestaShop 8.0.4 or 1.7.8.9 from official sources. 3. Follow PrestaShop upgrade documentation for your version. 4. Verify the patch by checking version in admin panel.
🔧 Temporary Workarounds
No known workarounds
allThe vendor advisory states there are no known workarounds for this vulnerability.
🧯 If You Can't Patch
- Restrict back-office user access to minimum necessary personnel only
- Implement strict database permission controls and monitor for unusual database activity
🔍 How to Verify
Check if Vulnerable:
Check PrestaShop version in admin panel under Advanced Parameters > Information. If version is below 8.0.4 (for 8.x) or below 1.7.8.9 (for 1.7.x), you are vulnerable.Check Version:
Check admin panel or look for version in /config/settings.inc.php fileVerify Fix Applied:
After patching, verify version shows 8.0.4 or higher, or 1.7.8.9 or higher. Check that the specific commit hashes are present in your installation.📡 Detection & Monitoring
Log Indicators:
- Unusual database queries from back-office users
- Multiple UPDATE/DELETE operations from single user sessions
- SQL error messages containing user input
Network Indicators:
- Unusual database connection patterns
- Large data transfers from database server
SIEM Query:
source="prestashop_logs" AND (sql_error OR database_query) AND user_role="backoffice"🔗 References
- https://github.com/PrestaShop/PrestaShop/commit/0f2a9b7fdd42d1dd3b21d4fad586a849642f3c30
- https://github.com/PrestaShop/PrestaShop/commit/d1d27dc371599713c912b71bc2a455cacd7f2149
- https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-p379-cxqh-q822
- https://github.com/PrestaShop/PrestaShop/commit/0f2a9b7fdd42d1dd3b21d4fad586a849642f3c30
- https://github.com/PrestaShop/PrestaShop/commit/d1d27dc371599713c912b71bc2a455cacd7f2149
- https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-p379-cxqh-q822
