CVE-2023-46353
📋 TL;DR
This vulnerability allows unauthenticated attackers to execute arbitrary SQL queries on PrestaShop installations using the vulnerable 'Product Tag Icons Pro' module. Attackers can potentially read, modify, or delete database content, including sensitive customer and administrative data. All PrestaShop sites using affected versions of this third-party module are vulnerable.
💻 Affected Systems
- Product Tag Icons Pro (ticons) module for PrestaShop
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, authentication bypass, and potential remote code execution via database functions.
Likely Case
Data exfiltration of customer information (names, addresses, payment details), administrative credential theft, and website defacement.
If Mitigated
Limited impact if database permissions are restricted, but still potential for data leakage from accessible tables.
🎯 Exploit Status
Exploitation requires only HTTP requests to vulnerable endpoints. The advisory includes technical details that facilitate exploit development.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.8.4
Vendor Advisory: https://security.friendsofpresta.org/modules/2023/11/28/ticons.html
Restart Required: No
Instructions:
1. Log into PrestaShop admin panel. 2. Navigate to Modules > Module Manager. 3. Find 'Product Tag Icons Pro' module. 4. Update to version 1.8.4 or later from MyPresta.eu marketplace. 5. Clear PrestaShop cache.
🔧 Temporary Workarounds
Disable vulnerable module
allTemporarily disable the module until patching is possible
Web Application Firewall rules
allBlock SQL injection patterns targeting the vulnerable endpoint
🧯 If You Can't Patch
- Disable the 'Product Tag Icons Pro' module completely
- Implement strict network filtering to limit access to PrestaShop admin and API endpoints
🔍 How to Verify
Check if Vulnerable:
Check module version in PrestaShop admin panel under Modules > Module Manager > Product Tag Icons ProCheck Version:
No direct CLI command; check via PrestaShop admin interfaceVerify Fix Applied:
Confirm module version is 1.8.4 or higher in the module manager📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in PrestaShop logs
- Multiple requests to module endpoints with SQL-like parameters
Network Indicators:
- HTTP requests containing SQL keywords (UNION, SELECT, etc.) to ticons-related endpoints
SIEM Query:
web.url:*ticons* AND (http.method:POST OR http.method:GET) AND (http.query:*UNION* OR http.query:*SELECT* OR http.query:*INSERT*)