CVE-2024-25845
📋 TL;DR
This vulnerability allows unauthenticated attackers to perform SQL injection attacks against PrestaShop installations using the 'CD Custom Fields 4 Orders' module version 1.0.0 or earlier. Attackers can potentially access, modify, or delete database content. All PrestaShop sites using this vulnerable module are affected.
💻 Affected Systems
- CD Custom Fields 4 Orders module for PrestaShop
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including theft of customer data, administrative credentials, and potential remote code execution through database functions.
Likely Case
Data exfiltration of customer information, order details, and potentially administrative credentials leading to site takeover.
If Mitigated
Limited impact if database permissions are properly restricted and input validation is implemented elsewhere.
🎯 Exploit Status
SQL injection vulnerabilities are commonly weaponized, and this one requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: > 1.0.0
Vendor Advisory: https://www.cleanpresta.com
Restart Required: No
Instructions:
1. Log into PrestaShop admin panel. 2. Navigate to Modules > Module Manager. 3. Find 'CD Custom Fields 4 Orders'. 4. Check for updates or remove if no update available. 5. If updating, download latest version from Cleanpresta.com. 6. Upload and install updated module.
🔧 Temporary Workarounds
Disable vulnerable module
allTemporarily disable the CD Custom Fields 4 Orders module until patched
Navigate to PrestaShop admin > Modules > Module Manager > CD Custom Fields 4 Orders > Disable
Web Application Firewall rules
allImplement WAF rules to block SQL injection patterns targeting this module
Configure WAF to block SQL injection patterns in requests to modules/cdcustomfields4orders/
🧯 If You Can't Patch
- Remove the CD Custom Fields 4 Orders module completely from the PrestaShop installation
- Implement strict input validation and parameterized queries at the application level
🔍 How to Verify
Check if Vulnerable:
Check PrestaShop admin panel > Modules > Module Manager > CD Custom Fields 4 Orders > check version numberCheck Version:
Check version in PrestaShop admin panel or examine modules/cdcustomfields4orders/ directory for version fileVerify Fix Applied:
Verify module version is greater than 1.0.0 in module manager📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts from single IP
- Requests to modules/cdcustomfields4orders/ with SQL syntax
Network Indicators:
- Unusual database traffic patterns
- Requests containing SQL keywords to module endpoints
SIEM Query:
source="web_logs" AND uri="*cdcustomfields4orders*" AND (query="*UNION*" OR query="*SELECT*" OR query="*INSERT*" OR query="*DELETE*")