CVE-2023-40922
📋 TL;DR
This SQL injection vulnerability in kerawen e-commerce software allows attackers to execute arbitrary SQL commands through the ocs_id_cart parameter. Attackers could potentially access, modify, or delete database contents. All kerawen installations before version 2.5.1 are affected.
💻 Affected Systems
- kerawen
📦 What is this software?
Kerawen by Kerawen
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or remote code execution via database functions.
Likely Case
Unauthorized data access including customer information, order details, and potentially administrative credentials.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to specific tables.
🎯 Exploit Status
SQL injection via HTTP parameter requires minimal technical skill to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.5.1
Vendor Advisory: https://security.friendsofpresta.org/modules/2023/11/02/kerawen.html
Restart Required: No
Instructions:
1. Backup your kerawen installation and database. 2. Download kerawen v2.5.1 or later. 3. Replace affected files with patched version. 4. Verify functionality.
🔧 Temporary Workarounds
Input Validation Filter
allAdd parameter validation to reject non-numeric ocs_id_cart values
Modify KerawenDeliveryModuleFrontController::initContent() to validate ocs_id_cart parameter as integer
Web Application Firewall
allDeploy WAF rules to block SQL injection patterns
Add WAF rule: deny requests containing SQL keywords in ocs_id_cart parameter
🧯 If You Can't Patch
- Implement strict input validation for all user-supplied parameters
- Restrict database user permissions to minimum required access
🔍 How to Verify
Check if Vulnerable:
Check kerawen version in admin panel or module files. If version < 2.5.1, system is vulnerable.Check Version:
Check kerawen module version in PrestaShop back office or examine module filesVerify Fix Applied:
Confirm kerawen version is 2.5.1 or later and test ocs_id_cart parameter with SQL injection payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple requests with SQL keywords in parameters
- Unexpected database queries
Network Indicators:
- HTTP requests containing SQL syntax in ocs_id_cart parameter
- Unusual database connection patterns
SIEM Query:
source="web_logs" AND (ocs_id_cart AND (SELECT|UNION|INSERT|DELETE|DROP|--|/*))