CVE-2023-45380
📋 TL;DR
This vulnerability in the PrestaShop 'Order Duplicator' module allows unauthenticated guests to download customer personal information including names, addresses, and phone numbers. It affects all PrestaShop installations using the vulnerable module version. The issue stems from insufficient access controls on data export functionality.
💻 Affected Systems
- PrestaShop Order Duplicator module (orderduplicate)
📦 What is this software?
Order Duplicator by Silbersaiten
⚠️ Risk & Real-World Impact
Worst Case
Mass exfiltration of all customer PII (personally identifiable information) leading to identity theft, phishing campaigns, regulatory fines (GDPR/CCPA), and reputational damage.
Likely Case
Targeted harvesting of customer data for spam, social engineering, or sale on dark web markets.
If Mitigated
No data exposure with proper access controls or module removal.
🎯 Exploit Status
The vulnerability requires simple HTTP requests to specific endpoints without authentication. Public proof-of-concept details are available in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.8 or later
Vendor Advisory: https://security.friendsofpresta.org/modules/2023/11/07/orderduplicate.html
Restart Required: No
Instructions:
1. Log into PrestaShop admin panel. 2. Navigate to Modules > Module Manager. 3. Search for 'Order Duplicator'. 4. Click 'Upgrade' to version 1.1.8 or later. 5. Alternatively, download latest version from addons.prestashop.com and upload manually.
🔧 Temporary Workarounds
Disable vulnerable module
allTemporarily disable the Order Duplicator module until patched.
Navigate to Modules > Module Manager in PrestaShop admin, find 'Order Duplicator', click 'Disable'
Remove module completely
allUninstall the vulnerable module if functionality is not required.
Navigate to Modules > Module Manager in PrestaShop admin, find 'Order Duplicator', click 'Uninstall'
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block requests to the vulnerable module endpoints
- Restrict access to the module's controller files via .htaccess or web server configuration
🔍 How to Verify
Check if Vulnerable:
Check module version in PrestaShop admin panel under Modules > Module Manager > Order Duplicator. If version is 1.1.7 or earlier, you are vulnerable.Check Version:
No CLI command - check via PrestaShop admin interface or examine /modules/orderduplicate/orderduplicate.php file version headerVerify Fix Applied:
After update, verify module version shows 1.1.8 or later. Test that guest users cannot access customer data export functionality.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /modules/orderduplicate/export.php or similar export endpoints from unauthenticated users
- Unusual download patterns of customer data files
Network Indicators:
- GET/POST requests to module export endpoints without authentication cookies
- Bursts of data downloads from customer data endpoints
SIEM Query:
web_access_logs | where url contains "/modules/orderduplicate/" and (user_agent not contains "bot" or is null) and status_code = 200 | where authenticated_user = "guest" or authenticated_user is null