CVE-2023-39641
📋 TL;DR
This SQL injection vulnerability in the psaffiliate PrestaShop module allows attackers to execute arbitrary SQL commands through the PsaffiliateGetaffiliatesdetailsModuleFrontController::initContent() component. Attackers can potentially read, modify, or delete database content, including sensitive customer and order information. All PrestaShop installations using psaffiliate versions before 1.9.8 are affected.
💻 Affected Systems
- Active Design psaffiliate PrestaShop module
📦 What is this software?
Full Affiliates by Activedesign
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, privilege escalation, and potential remote code execution via database functions.
Likely Case
Unauthorized access to sensitive affiliate, customer, and order data, potentially leading to data exfiltration and business disruption.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permission restrictions in place.
🎯 Exploit Status
SQL injection vulnerabilities are typically easy to exploit with automated tools. The specific exploit path is documented in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.9.8
Vendor Advisory: https://security.friendsofpresta.org/modules/2023/08/31/psaffiliate.html
Restart Required: No
Instructions:
1. Log into PrestaShop admin panel. 2. Navigate to Modules > Module Manager. 3. Find 'psaffiliate' module. 4. Click 'Upgrade' to version 1.9.8 or later. 5. Alternatively, download from addons.prestashop.com and manually upload.
🔧 Temporary Workarounds
Disable psaffiliate module
allTemporarily disable the vulnerable module until patching is possible
UPDATE ps_module SET active = 0 WHERE name = 'psaffiliate';
Implement WAF rules
allAdd web application firewall rules to block SQL injection patterns targeting the vulnerable endpoint
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all user inputs
- Apply principle of least privilege to database user accounts
🔍 How to Verify
Check if Vulnerable:
Check module version in PrestaShop admin panel under Modules > Module Manager > psaffiliateCheck Version:
SELECT version FROM ps_module WHERE name = 'psaffiliate';Verify Fix Applied:
Confirm psaffiliate module version is 1.9.8 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in web server logs
- Multiple requests to /module/psaffiliate/getaffiliatesdetails endpoint with SQL patterns
Network Indicators:
- HTTP requests containing SQL keywords (UNION, SELECT, INSERT) targeting the vulnerable endpoint
SIEM Query:
web.url:*getaffiliatesdetails* AND (web.query:*UNION* OR web.query:*SELECT* OR web.query:*INSERT*)🔗 References
- https://addons.prestashop.com/fr/referencement-payant-affiliation/26226-full-affiliates.html
- https://security.friendsofpresta.org/modules/2023/08/31/psaffiliate.html
- https://addons.prestashop.com/fr/referencement-payant-affiliation/26226-full-affiliates.html
- https://security.friendsofpresta.org/modules/2023/08/31/psaffiliate.html
