CVE-2023-45377
📋 TL;DR
This vulnerability allows unauthenticated attackers to execute arbitrary SQL commands on PrestaShop installations using the Chronopost Official module. Attackers can potentially access, modify, or delete database content. All PrestaShop sites with the vulnerable Chronopost module are affected.
💻 Affected Systems
- PrestaShop Chronopost Official module
📦 What is this software?
Chronopost by Chronopost
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to remote code execution.
Likely Case
Database information disclosure, data manipulation, or privilege escalation affecting e-commerce operations.
If Mitigated
Limited impact if proper input validation and parameterized queries are implemented, though SQL injection attempts may still be logged.
🎯 Exploit Status
Exploitation requires only HTTP access to cancelSkybill.php with crafted parameters.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Updated Chronopost module version
Vendor Advisory: https://security.friendsofpresta.org/modules/2023/11/21/chronopost.html
Restart Required: No
Instructions:
1. Update Chronopost module to latest version via PrestaShop admin panel. 2. Verify module update completes successfully. 3. Test functionality remains intact.
🔧 Temporary Workarounds
Disable vulnerable endpoint
linuxTemporarily block access to cancelSkybill.php file
mv modules/chronopost/cancelSkybill.php modules/chronopost/cancelSkybill.php.disabled
Web server access restriction
allConfigure web server to deny access to vulnerable script
Add 'Deny from all' to .htaccess for cancelSkybill.php directory
🧯 If You Can't Patch
- Implement WAF rules to block SQL injection patterns targeting cancelSkybill.php
- Restrict network access to PrestaShop admin interface and vulnerable endpoints
🔍 How to Verify
Check if Vulnerable:
Check if modules/chronopost/cancelSkybill.php exists and contains unsanitized SQL queries with user input.Check Version:
Check PrestaShop admin panel → Modules → Module Manager for Chronopost versionVerify Fix Applied:
Verify cancelSkybill.php uses parameterized queries or has been removed/updated in module update.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /modules/chronopost/cancelSkybill.php with SQL keywords in parameters
- Database error logs showing SQL syntax errors from Chronopost module
Network Indicators:
- Unusual SQL queries originating from web server to database
- HTTP traffic patterns matching SQL injection attempts
SIEM Query:
source="web_access.log" AND uri="/modules/chronopost/cancelSkybill.php" AND (param="SELECT" OR param="UNION" OR param="OR 1=1")