CVE-2024-36678
📋 TL;DR
This vulnerability allows unauthenticated attackers to execute arbitrary SQL queries on PrestaShop installations using the vulnerable pk_themesettings module. Attackers can potentially steal sensitive data, modify database contents, or gain administrative access. All PrestaShop sites using affected versions of the pk_themesettings module are at risk.
💻 Affected Systems
- PrestaShop module pk_themesettings from Promokit.eu
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation to admin, and potential remote code execution via database functions.
Likely Case
Data exfiltration of customer information, order data, and administrative credentials stored in the database.
If Mitigated
Limited impact if database permissions are restricted and web application firewall blocks SQL injection patterns.
🎯 Exploit Status
The vulnerability is in ajax.php which accepts user input directly in SQL queries without proper sanitization.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.8.9 or later
Vendor Advisory: https://security.friendsofpresta.org/modules/2024/06/18/pk_themesettings.html
Restart Required: No
Instructions:
1. Update the pk_themesettings module to version 1.8.9 or later via PrestaShop admin panel. 2. Alternatively, download the updated module from Promokit.eu and replace the existing files. 3. Clear PrestaShop cache after update.
🔧 Temporary Workarounds
Disable vulnerable module
allTemporarily disable the pk_themesettings module until patched
Navigate to PrestaShop admin > Modules > Module Manager > Find pk_themesettings > Disable
Block ajax.php access
linuxRestrict access to the vulnerable ajax.php file via web server configuration
# Apache: <Location /modules/pk_themesettings/ajax.php> Require all denied </Location>
# Nginx: location ~ /modules/pk_themesettings/ajax\.php$ { deny all; }
🧯 If You Can't Patch
- Disable the pk_themesettings module immediately
- Implement web application firewall rules to block SQL injection patterns targeting the ajax.php endpoint
🔍 How to Verify
Check if Vulnerable:
Check PrestaShop admin panel > Modules > Module Manager for pk_themesettings version. If version is 1.8.8 or lower, you are vulnerable.Check Version:
Check modules/pk_themesettings/pk_themesettings.php for version number in header commentsVerify Fix Applied:
Verify pk_themesettings module version is 1.8.9 or higher in PrestaShop admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in web server logs
- Multiple requests to /modules/pk_themesettings/ajax.php with SQL-like parameters
- Database error logs showing unexpected queries
Network Indicators:
- HTTP POST/GET requests to ajax.php with SQL keywords in parameters
- Unusual database connection patterns from web server
SIEM Query:
web.url:*pk_themesettings/ajax.php AND (web.query:*UNION* OR web.query:*SELECT* OR web.query:*INSERT* OR web.query:*UPDATE* OR web.query:*DELETE*)