CVE-2024-25849
📋 TL;DR
This vulnerability allows unauthenticated attackers to perform SQL injection attacks on PrestaShop websites using the 'Make an offer' module version 1.7.1 or earlier. Attackers can potentially access, modify, or delete database content. All PrestaShop installations with this vulnerable module are affected.
💻 Affected Systems
- PrestaShop Make an offer module (makeanoffer)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation, remote code execution, or complete system takeover.
Likely Case
Data exfiltration including customer information, order details, and potentially administrative credentials stored in the database.
If Mitigated
Limited impact if database permissions are properly restricted and input validation is enforced at other layers.
🎯 Exploit Status
SQL injection vulnerabilities are commonly weaponized, and this affects a popular e-commerce platform module.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: > 1.7.1
Vendor Advisory: https://security.friendsofpresta.org/modules/2024/03/05/makeanoffer.html
Restart Required: No
Instructions:
1. Log into PrestaShop admin panel. 2. Navigate to Modules > Module Manager. 3. Search for 'Make an offer' module. 4. Update to latest version (>1.7.1). 5. Clear PrestaShop cache.
🔧 Temporary Workarounds
Disable vulnerable module
allTemporarily disable the 'Make an offer' module until patching is possible.
Navigate to PrestaShop admin > Modules > Module Manager > Disable 'Make an offer' module
Web Application Firewall rules
allImplement WAF rules to block SQL injection patterns targeting the vulnerable endpoints.
Configure WAF to block SQL injection patterns in requests to /modules/makeanoffer/ endpoints
🧯 If You Can't Patch
- Disable the 'Make an offer' module completely
- Implement network segmentation to isolate the PrestaShop server and restrict database access
🔍 How to Verify
Check if Vulnerable:
Check module version in PrestaShop admin panel under Modules > Module Manager > Make an offer module details.Check Version:
Check PrestaShop database: SELECT version FROM ps_module WHERE name = 'makeanoffer';Verify Fix Applied:
Confirm module version is >1.7.1 and test that SQL injection attempts are properly sanitized.📡 Detection & Monitoring
Log Indicators:
- SQL error messages in PrestaShop logs
- Unusual database queries from web server IP
- Multiple failed SQL injection attempts in access logs
Network Indicators:
- SQL injection patterns in HTTP requests to /modules/makeanoffer/
- Unusual database traffic from web server
SIEM Query:
source="prestashop_logs" AND ("SQL syntax" OR "You have an error in your SQL syntax" OR "makeanoffer")