SQL filtering vulnerability, a BO user can write, update and delete in the database, even without having specific rights.

Summary

  • CVE ID: CVE-2023-30839
  • Published at: 2022-05-03
  • Advisory source: PrestaShop
  • Platform: PrestaShop
  • Product: PrestaShop
  • Impacted release: >= 8.0.0 < 8.0.3 and < 1.7.8.8 (Patched versions 8.0.4 and 1.7.8.9)
  • Weakness: CWE-22
  • Severity: high (8.8) (source NVD)*

Description

It is possible for a user having access to the SQL Manager (Advanced Options -> Database) to arbitrary read any file on the Operating system when using SQL function LOAD_FILE in a SELECT request. So It can access to critical information.

CVSS base metrics

  • Attack vector: network
  • Attack complexity: low
  • Privilege required: low
  • User interaction: required
  • Scope: unchanged
  • Confidentiality: high
  • Integrity: high
  • Availability: high

Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (source NVD)*

*

According to Friends of Presta, the severity is lower than 8.8. The vunlerability is only in backoffice, we consider Privilege required sould be “high”.

Possible malicious usage

  • Obtain database access
  • Extract sensitive data, such as tokens or private keys stored in config files
  • Extract other private data, such as log files or exports

Patch

--- a/classes/db/Db.php
+++ b/classes/db/Db.php
@@ -603,11 +603,7 @@ public function executeS($sql, $array = true, $use_cache = true)
 
         // This method must be used only with queries which display results
         if (!preg_match('#^\s*\(?\s*(select|show|explain|describe|desc)\s#i', $sql)) {
-            if (defined('_PS_MODE_DEV_') && _PS_MODE_DEV_) {
-                throw new PrestaShopDatabaseException('Db->executeS() must be used only with select, show, explain or describe queries');
-            }
-
-            return $this->execute($sql, $use_cache);
+            throw new PrestaShopDatabaseException('Db->executeS() must be used only with select, show, explain or describe queries');
         }
 
         $this->result = $this->query($sql);

Other recommendations

  • It’s recommended to upgrade to the latest version of the PrestaShop 1.7.8.9 or 8.0.4.