CVE-2023-46351
📋 TL;DR
This vulnerability allows unauthenticated attackers to execute arbitrary SQL queries on PrestaShop installations using the mib module from MyPresta.eu. Attackers can potentially access, modify, or delete database content, including sensitive customer data. All PrestaShop sites using the vulnerable mib module are affected.
💻 Affected Systems
- PrestaShop mib module from MyPresta.eu
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE chaining.
Likely Case
Data exfiltration of customer information, order details, and administrative credentials stored in the database.
If Mitigated
Limited impact if proper input validation and prepared statements are implemented, though SQL injection attempts would still be logged.
🎯 Exploit Status
Exploitation requires only HTTP access to the vulnerable endpoint with crafted parameters.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.6.1
Vendor Advisory: https://mypresta.eu/modules/front-office-features/manufacturers-brands-images-block.html
Restart Required: No
Instructions:
1. Log into PrestaShop admin panel. 2. Navigate to Modules > Module Manager. 3. Find 'mib' module. 4. Click 'Upgrade' to version 1.6.1 or later. 5. Alternatively, download from MyPresta.eu and manually upload.
🔧 Temporary Workarounds
Disable mib module
allTemporarily disable the vulnerable module until patching is possible.
Navigate to Modules > Module Manager in PrestaShop admin, find 'mib', click 'Disable'
WAF rule for SQL injection
allImplement web application firewall rules to block SQL injection patterns targeting the vulnerable endpoint.
Add WAF rule: Block requests containing SQL keywords to /modules/mib/mib.php
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries in the mib::getManufacturersByCategory() method
- Restrict access to the vulnerable endpoint using IP whitelisting or authentication requirements
🔍 How to Verify
Check if Vulnerable:
Check module version in PrestaShop admin under Modules > Module Manager > mib module details.Check Version:
SELECT version FROM ps_module WHERE name = 'mib'Verify Fix Applied:
Confirm mib module version is 1.6.1 or higher in module details.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in PrestaShop logs
- Multiple requests to /modules/mib/mib.php with SQL-like parameters
Network Indicators:
- HTTP requests to vulnerable endpoint with SQL injection payloads in parameters
SIEM Query:
source="prestashop.log" AND "mib" AND ("SQL" OR "syntax" OR "UNION" OR "SELECT")🔗 References
- https://mypresta.eu/modules/front-office-features/manufacturers-brands-images-block.html
- https://security.friendsofpresta.org/modules/2024/01/18/mib.html
- https://mypresta.eu/modules/front-office-features/manufacturers-brands-images-block.html
- https://security.friendsofpresta.org/modules/2024/01/18/mib.html
