CVE-2023-50061
📋 TL;DR
This vulnerability allows attackers to execute arbitrary SQL commands on PrestaShop installations using the Op'art Easy Redirect module. Attackers can potentially read, modify, or delete database content, including sensitive customer data. All PrestaShop sites using affected versions of the Op'art Easy Redirect module are vulnerable.
💻 Affected Systems
- PrestaShop Op'art Easy Redirect module
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, website defacement, or full system takeover through SQL injection to remote code execution chaining.
Likely Case
Database information disclosure including customer data, admin credentials, and configuration secrets.
If Mitigated
Limited impact with proper input validation and database permissions, though SQL injection remains dangerous.
🎯 Exploit Status
SQL injection via hookActionDispatcher() function suggests straightforward exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.3.13 or later
Vendor Advisory: https://security.friendsofpresta.org/modules/2024/02/08/oparteasyredirect.html
Restart Required: No
Instructions:
1. Log into PrestaShop admin panel
2. Navigate to Modules > Module Manager
3. Search for 'Op'art Easy Redirect'
4. Update to version 1.3.13 or later
5. Clear PrestaShop cache
🔧 Temporary Workarounds
Disable vulnerable module
allTemporarily disable the Op'art Easy Redirect module until patched
Web Application Firewall rules
allImplement WAF rules to block SQL injection patterns targeting hookActionDispatcher
🧯 If You Can't Patch
- Disable the Op'art Easy Redirect module immediately
- Implement strict input validation and parameterized queries at application level
🔍 How to Verify
Check if Vulnerable:
Check module version in PrestaShop admin panel under Modules > Module Manager > Op'art Easy RedirectCheck Version:
No direct command; check via PrestaShop admin interfaceVerify Fix Applied:
Confirm module version is 1.3.13 or later in admin panel📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple requests to hookActionDispatcher with SQL-like parameters
- Database error messages containing SQL syntax
Network Indicators:
- HTTP POST requests with SQL injection payloads targeting the vulnerable endpoint
SIEM Query:
web_requests WHERE url CONTAINS 'hookActionDispatcher' AND (params CONTAINS 'UNION' OR params CONTAINS 'SELECT' OR params CONTAINS 'OR 1=1')