CVE-2023-48925
📋 TL;DR
This SQL injection vulnerability in the Buy Addons bavideotab module for PrestaShop allows attackers to execute arbitrary SQL commands through the BaVideoTabSaveVideoModuleFrontController::run() function. Attackers can escalate privileges and access sensitive database information. All PrestaShop installations using bavideotab versions before 1.0.6 are affected.
💻 Affected Systems
- Buy Addons bavideotab module for PrestaShop
📦 What is this software?
Bavideotab by Buy Addons
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to admin account takeover, data exfiltration, and potential remote code execution through database functions.
Likely Case
Privilege escalation to admin level, access to customer data, and manipulation of shop content.
If Mitigated
Limited impact with proper input validation and database permissions, but still potential for data leakage.
🎯 Exploit Status
SQL injection vulnerabilities are commonly weaponized. The front controller suggests unauthenticated access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.6
Vendor Advisory: https://security.friendsofpresta.org/modules/2023/12/07/bavideotab.html
Restart Required: No
Instructions:
1. Log into PrestaShop admin panel. 2. Navigate to Modules > Module Manager. 3. Find bavideotab module. 4. Update to version 1.0.6 or later. 5. Clear PrestaShop cache.
🔧 Temporary Workarounds
Disable bavideotab module
allTemporarily disable the vulnerable module until patching is possible
UPDATE ps_module SET active = 0 WHERE name = 'bavideotab';
Web Application Firewall rules
allImplement WAF rules to block SQL injection patterns targeting the vulnerable endpoint
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries at application level
- Restrict database user permissions to minimum required privileges
🔍 How to Verify
Check if Vulnerable:
Check module version in PrestaShop admin panel under Modules > Module Manager > bavideotabCheck Version:
SELECT version FROM ps_module WHERE name = 'bavideotab';Verify Fix Applied:
Confirm bavideotab version is 1.0.6 or higher in module manager📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by successful admin login
- Requests to /modules/bavideotab/controllers/front/saveVideo
Network Indicators:
- POST requests with SQL injection patterns in parameters
- Unusual traffic to module endpoints
SIEM Query:
source="web_logs" AND (uri="/modules/bavideotab/*" AND (param="' OR '1'='1" OR param="' UNION SELECT"))