CVE-2023-45386
📋 TL;DR
This SQL injection vulnerability in the extratabspro PrestaShop module allows unauthenticated attackers to execute arbitrary SQL commands. All PrestaShop installations using vulnerable versions of this module are affected, potentially leading to complete database compromise.
💻 Affected Systems
- PrestaShop extratabspro module
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database takeover allowing data theft, modification, or deletion, potentially leading to remote code execution via database functions.
Likely Case
Data exfiltration of customer information, order data, and administrative credentials stored in the database.
If Mitigated
Limited impact if database user has minimal privileges and input validation blocks malicious payloads.
🎯 Exploit Status
Exploitation is straightforward via HTTP requests to vulnerable endpoints without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.2.8
Vendor Advisory: https://security.friendsofpresta.org/modules/2023/10/12/extratabspro.html
Restart Required: No
Instructions:
1. Log into PrestaShop admin panel
2. Navigate to Modules > Module Manager
3. Search for 'extratabspro'
4. Click 'Upgrade' to version 2.2.8
5. Clear PrestaShop cache
🔧 Temporary Workarounds
Disable vulnerable module
allTemporarily disable the extratabspro module until patching is possible
UPDATE ps_module SET active = 0 WHERE name = 'extratabspro';
Web Application Firewall rule
linuxBlock requests to vulnerable endpoints
LocationMatch "\/modules\/extratabspro\/"
Deny from all
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries at application level
- Restrict database user permissions to minimum required operations
🔍 How to Verify
Check if Vulnerable:
Check module version in PrestaShop admin panel under Modules > Module Manager > extratabsproCheck Version:
SELECT version FROM ps_module WHERE name = 'extratabspro';Verify Fix Applied:
Confirm module version shows 2.2.8 or higher in admin panel📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in web server logs
- Multiple requests to /modules/extratabspro/ endpoints with SQL keywords
Network Indicators:
- HTTP POST/GET requests containing SQL injection payloads to vulnerable endpoints
SIEM Query:
source="webserver.log" AND ("extratabspro" AND ("UNION" OR "SELECT" OR "INSERT" OR "DELETE"))