CVE-2023-39526
📋 TL;DR
This CVE allows attackers to execute arbitrary code on PrestaShop e-commerce platforms through SQL injection and arbitrary file write vulnerabilities in the back office. Attackers can gain full control of affected systems, potentially stealing customer data, modifying orders, or installing malware. All PrestaShop installations running vulnerable versions are affected.
💻 Affected Systems
- PrestaShop
📦 What is this software?
Prestashop by Prestashop
Prestashop by Prestashop
Prestashop by Prestashop
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise leading to data theft, ransomware deployment, defacement, and lateral movement to other systems in the network.
Likely Case
Attackers gain administrative access to the PrestaShop back office, allowing them to steal customer PII, payment information, modify orders, and install backdoors.
If Mitigated
Limited impact if proper network segmentation, WAF rules, and access controls prevent exploitation attempts from reaching vulnerable systems.
🎯 Exploit Status
Exploitation requires access to the back office, but SQL injection could potentially bypass authentication. The CVSS score of 9.1 indicates high exploitability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.8.10, 8.0.5, or 8.1.1
Vendor Advisory: https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-gf46-prm4-56pc
Restart Required: No
Instructions:
1. Backup your PrestaShop installation and database. 2. Update to version 1.7.8.10, 8.0.5, or 8.1.1 depending on your current major version. 3. Verify the update completed successfully. 4. Clear any caches and test functionality.
🧯 If You Can't Patch
- Restrict access to the PrestaShop back office using IP whitelisting and strong authentication
- Implement a Web Application Firewall (WAF) with SQL injection protection rules
🔍 How to Verify
Check if Vulnerable:
Check your PrestaShop version in the back office under Advanced Parameters > InformationCheck Version:
Check the /app/config/parameters.php file or back office information pageVerify Fix Applied:
Verify version is 1.7.8.10, 8.0.5, or 8.1.1 in the back office information page📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Unexpected file write operations in system logs
- Multiple failed login attempts to back office followed by successful access
Network Indicators:
- Unusual traffic patterns to back office endpoints
- SQL injection patterns in HTTP requests
SIEM Query:
source="prestashop_logs" AND (message="*sql*" OR message="*file_write*" OR message="*backoffice*" AND status="success")🔗 References
- https://github.com/PrestaShop/PrestaShop/commit/817847e2347844a9b6add017581f1932bcd28c09
- https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-gf46-prm4-56pc
- https://github.com/PrestaShop/PrestaShop/commit/817847e2347844a9b6add017581f1932bcd28c09
- https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-gf46-prm4-56pc
