CVE-2023-6921
📋 TL;DR
CVE-2023-6921 is a blind SQL injection vulnerability in the PrestaShow Google Integrator addon for PrestaShop that allows attackers to extract or modify database data by injecting malicious SQL commands via cookie manipulation. This affects PrestaShop websites using the vulnerable addon. Attackers can potentially access sensitive information like customer data, orders, or administrative credentials.
💻 Affected Systems
- PrestaShow Google Integrator (PrestaShop addon)
📦 What is this software?
Google Integrator by Prestashow
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, privilege escalation, and potential full system takeover if database credentials allow broader access.
Likely Case
Extraction of sensitive customer data (personal information, payment details), modification of orders or prices, and potential administrative account takeover.
If Mitigated
Limited data exposure if database permissions are properly restricted and sensitive data is encrypted.
🎯 Exploit Status
SQL injection via cookie manipulation is well-understood and easy to automate. The blind nature requires more requests but doesn't significantly increase complexity.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Updated version from vendor
Vendor Advisory: https://prestashow.pl/pl/moduly-prestashop/28-prestashop-google-integrator-ga4-gtm-ads-remarketing.html
Restart Required: No
Instructions:
1. Log into PrestaShop admin panel. 2. Navigate to Modules > Module Manager. 3. Find 'PrestaShow Google Integrator'. 4. Update to latest version. 5. Clear PrestaShop cache.
🔧 Temporary Workarounds
Disable vulnerable module
allTemporarily disable the PrestaShow Google Integrator module until patched
Navigate to Modules > Module Manager in PrestaShop admin, find 'PrestaShow Google Integrator', click Disable
WAF rule for SQL injection in cookies
allImplement web application firewall rules to block SQL injection patterns in cookie values
Depends on WAF platform - configure rules to inspect and block SQL keywords in cookie parameters
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries for all cookie processing
- Deploy a web application firewall with SQL injection protection for cookie parameters
🔍 How to Verify
Check if Vulnerable:
Check if PrestaShow Google Integrator module is installed and enabled in PrestaShop admin panel under Modules > Module ManagerCheck Version:
Check module version in PrestaShop admin panel under Modules > Module Manager > PrestaShow Google IntegratorVerify Fix Applied:
Verify module version is updated to latest and test cookie parameter handling with SQL injection test payloads📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple requests with SQL keywords in cookie values
- Patterns of failed login attempts following cookie manipulation
Network Indicators:
- HTTP requests containing SQL injection patterns in Cookie headers
- Unusual database query patterns from application server
SIEM Query:
source="web_logs" AND (Cookie="*UNION*" OR Cookie="*SELECT*" OR Cookie="*INSERT*" OR Cookie="*UPDATE*" OR Cookie="*DELETE*")🔗 References
- https://cert.pl/en/posts/2024/01/CVE-2023-6921/
- https://cert.pl/posts/2024/01/CVE-2023-6921/
- https://prestashow.pl/pl/moduly-prestashop/28-prestashop-google-integrator-ga4-gtm-ads-remarketing.html
- https://cert.pl/en/posts/2024/01/CVE-2023-6921/
- https://cert.pl/posts/2024/01/CVE-2023-6921/
- https://prestashow.pl/pl/moduly-prestashop/28-prestashop-google-integrator-ga4-gtm-ads-remarketing.html
