CVE-2023-33278
📋 TL;DR
This vulnerability allows unauthenticated attackers to execute blind SQL injection attacks via HTTP requests to the Store Commander scexportcustomers module in PrestaShop. It affects PrestaShop installations using the vulnerable module version, potentially exposing sensitive database information including customer data, credentials, and configuration details.
💻 Affected Systems
- PrestaShop with Store Commander scexportcustomers module
📦 What is this software?
Customers Export by Storecommander
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data exfiltration, privilege escalation, and potential remote code execution via database functions.
Likely Case
Extraction of sensitive customer data (PII, payment information), admin credentials, and database schema information.
If Mitigated
Limited information disclosure if database permissions are properly restricted and input validation is enforced elsewhere.
🎯 Exploit Status
Exploitation requires trivial HTTP requests with SQL injection payloads. Public proof-of-concept demonstrates blind SQL injection techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: scexportcustomers module version 3.6.2 or later
Vendor Advisory: https://friends-of-presta.github.io/security-advisories/modules/2023/05/25/scexportcustomers.html
Restart Required: No
Instructions:
1. Update the scexportcustomers module to version 3.6.2 or later via PrestaShop admin panel or manual installation. 2. Verify the module version in the module manager. 3. Clear any PrestaShop cache if applicable.
🔧 Temporary Workarounds
Disable vulnerable module
allTemporarily disable the scexportcustomers module until patched
Navigate to PrestaShop admin > Modules > Module Manager > Find scexportcustomers > Disable
Web Application Firewall rule
allBlock SQL injection patterns targeting the module endpoint
Add WAF rule to block requests containing SQL keywords to /modules/scexportcustomers/
🧯 If You Can't Patch
- Disable the scexportcustomers module immediately
- Implement network-level restrictions to limit access to the module endpoint
🔍 How to Verify
Check if Vulnerable:
Check module version in PrestaShop admin panel under Modules > Module Manager > scexportcustomers. If version is 3.6.1 or earlier, you are vulnerable.Check Version:
Check PrestaShop database: SELECT version FROM ps_module WHERE name = 'scexportcustomers';Verify Fix Applied:
Confirm module version is 3.6.2 or later in the module manager. Test the export functionality to ensure it works without errors.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /modules/scexportcustomers/ with SQL keywords (UNION, SELECT, INSERT, etc.)
- Unusual database query patterns from web server IP
Network Indicators:
- HTTP POST/GET requests to module endpoint with encoded SQL payloads
- Multiple rapid requests to customer export functionality
SIEM Query:
web.url:*scexportcustomers* AND (web.query:*UNION* OR web.query:*SELECT* OR web.query:*INSERT*)🔗 References
- https://friends-of-presta.github.io/security-advisories/modules/2023/05/25/scexportcustomers.html
- https://www.storecommander.com/en/addons/480-customer-export-pro.html
- https://friends-of-presta.github.io/security-advisories/modules/2023/05/25/scexportcustomers.html
- https://www.storecommander.com/en/addons/480-customer-export-pro.html
