CVE-2023-31671
📋 TL;DR
This vulnerability allows attackers to execute arbitrary SQL commands on PrestaShop installations using the PostFinance payment module version 17.1.13 or earlier. Attackers can potentially access, modify, or delete database content, including sensitive customer and payment information. All PrestaShop sites using the vulnerable PostFinance module are affected.
💻 Affected Systems
- PrestaShop PostFinance payment module
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, payment information exposure, site defacement, or full system takeover via SQL injection to RCE chaining.
Likely Case
Database information disclosure including customer data, order details, and potentially payment information extraction.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database user privilege restrictions in place.
🎯 Exploit Status
SQL injection via PostfinanceValidationModuleFrontController::postProcess() method. Public exploit details available in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: > 17.1.13
Vendor Advisory: https://friends-of-presta.github.io/security-advisories/modules/2023/06/13/postfinance.html
Restart Required: No
Instructions:
1. Update PostFinance module to latest version. 2. Remove old module files. 3. Upload new module files via PrestaShop admin panel. 4. Clear cache.
🔧 Temporary Workarounds
Disable PostFinance module
allTemporarily disable the vulnerable payment module until patching is possible
Navigate to PrestaShop admin > Modules > Module Manager > PostFinance > Disable
WAF rule implementation
allImplement web application firewall rules to block SQL injection patterns targeting the vulnerable endpoint
Add WAF rule: Block requests containing SQL injection patterns to /module/postfinance/validation
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all user inputs to the PostFinance module
- Restrict database user permissions to minimum required privileges (SELECT only if possible)
🔍 How to Verify
Check if Vulnerable:
Check module version in PrestaShop admin panel under Modules > Module Manager > PostFinanceCheck Version:
Check PrestaShop admin panel or examine module files for version informationVerify Fix Applied:
Verify PostFinance module version is > 17.1.13 and test payment functionality works correctly📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed payment validation attempts
- Requests to /module/postfinance/validation with SQL patterns
Network Indicators:
- HTTP POST requests to PostFinance validation endpoint with SQL injection payloads
SIEM Query:
source="web_logs" AND uri="/module/postfinance/validation" AND (payload CONTAINS "UNION" OR payload CONTAINS "SELECT" OR payload CONTAINS "INSERT" OR payload CONTAINS "DELETE")🔗 References
- https://friends-of-presta.github.io/security-advisories/modules/2023/06/13/postfinance.html
- https://shop.webbax.ch/modules-de-paiement/123-module-postfinance.html
- https://friends-of-presta.github.io/security-advisories/modules/2023/06/13/postfinance.html
- https://shop.webbax.ch/modules-de-paiement/123-module-postfinance.html
