CVE-2024-25843
📋 TL;DR
This vulnerability allows unauthenticated attackers to execute arbitrary SQL commands on PrestaShop installations using the affected ba_importer module. Attackers can potentially steal sensitive data, modify database contents, or gain administrative access. Any PrestaShop site using this vulnerable module version is affected.
💻 Affected Systems
- PrestaShop module: Import/Update Bulk Product from any Csv/Excel File Pro (ba_importer)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, website defacement, backdoor installation, and full administrative control of the PrestaShop instance.
Likely Case
Data exfiltration of customer information, product data, and administrative credentials, potentially leading to follow-on attacks.
If Mitigated
Limited impact if proper input validation and parameterized queries are implemented, though some data exposure may still occur.
🎯 Exploit Status
SQL injection vulnerabilities are commonly weaponized, and this one requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.1.29 or later
Vendor Advisory: https://security.friendsofpresta.org/modules/2024/02/27/ba_importer.html
Restart Required: No
Instructions:
1. Log into PrestaShop admin panel. 2. Navigate to Modules > Module Manager. 3. Find 'Import/Update Bulk Product from any Csv/Excel File Pro'. 4. Update to version 1.1.29 or later. 5. Clear PrestaShop cache.
🔧 Temporary Workarounds
Disable vulnerable module
allTemporarily disable the ba_importer module until patched
UPDATE ps_module SET active = 0 WHERE name = 'ba_importer';
Restrict module access
linuxConfigure .htaccess or web server rules to block access to the module's controller
# Add to .htaccess: RewriteRule ^modules/ba_importer/ - [F,L]
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block SQL injection patterns
- Disable the module entirely and use alternative import methods
🔍 How to Verify
Check if Vulnerable:
Check module version in PrestaShop admin panel under Modules > Module Manager > ba_importerCheck Version:
SELECT version FROM ps_module WHERE name = 'ba_importer';Verify Fix Applied:
Confirm module version is 1.1.29 or higher in the module manager📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts from single IP
- Unexpected database errors in web server logs
Network Indicators:
- HTTP requests with SQL keywords to module endpoints
- Unusual outbound database connections
SIEM Query:
source="web_server" AND (url="*ba_importer*" AND (query="*SELECT*" OR query="*UNION*" OR query="*INSERT*" OR query="*DELETE*"))🔗 References
- https://addons.prestashop.com/en/data-import-export/20579-import-update-bulk-product-from-any-csv-excel-file-pro.html
- https://security.friendsofpresta.org/modules/2024/02/27/ba_importer.html
- https://addons.prestashop.com/en/data-import-export/20579-import-update-bulk-product-from-any-csv-excel-file-pro.html
- https://security.friendsofpresta.org/modules/2024/02/27/ba_importer.html
