PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, SQL injection possible in the product search field, in BO’s product page. Version 8.1.1 contains a patch for this issue.

Summary

  • CVE ID: CVE-2023-39524
  • Published at: 2023-08-07
  • Advisory source: PrestaShop
  • Platform: PrestaShop
  • Product: PrestaShop
  • Impacted release: > 8.0.0 and <= 8.1.0, 8.1.1 patched the issue
  • Product author: PrestaShop
  • Weakness: CWE-89
  • Severity: medium (7.2)

Description

SQL injection possible in product search field, in BO’s product page nammed v2 on associated product ajax request.

CVSS base metrics

  • Attack vector: network
  • Attack complexity: none
  • Privilege required: high
  • User interaction: none
  • Scope: unchanged
  • Confidentiality: low
  • Integrity: high
  • Availability: high

Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Possible malicious usage

  • Elevate privileges to super admin
  • Remove data from the associated PrestaShop
  • Rewrite SMTP settings to hijack emails

patch

--- a/src/Adapter/Product/Repository/ProductRepository.php
+++ b/src/Adapter/Product/Repository/ProductRepository.php
@@ -889,7 +889,7 @@ protected function getSearchQueryBuilder(
             ->addGroupBy('p.id_product')
         ;
 
-        $dbSearchPhrase = sprintf('"%%%s%%"', $searchPhrase);
+        $dbSearchPhrase = sprintf('"%%%s%%"', pSQL($searchPhrase));
         $qb->where($qb->expr()->or(
             $qb->expr()->like('pl.name', $dbSearchPhrase),

In this case, considered as a better solution because the main default of this request is that the SQL is not well prepared (using PDO):

--- a/src/Adapter/Product/Repository/ProductRepository.php
+++ b/src/Adapter/Product/Repository/ProductRepository.php
@@ -889,26 +889,27 @@ protected function getSearchQueryBuilder(
             ->addGroupBy('p.id_product')
         ;
 
-        $dbSearchPhrase = sprintf('"%%%s%%"', $searchPhrase);
         $qb->where($qb->expr()->or(
-            $qb->expr()->like('pl.name', $dbSearchPhrase),
+            $qb->expr()->like('pl.name', ':dbSearchPhrase'),
 
             // Product references
-            $qb->expr()->like('p.isbn', $dbSearchPhrase),
-            $qb->expr()->like('p.upc', $dbSearchPhrase),
-            $qb->expr()->like('p.mpn', $dbSearchPhrase),
-            $qb->expr()->like('p.reference', $dbSearchPhrase),
-            $qb->expr()->like('p.ean13', $dbSearchPhrase),
-            $qb->expr()->like('p.supplier_reference', $dbSearchPhrase),
+            $qb->expr()->like('p.isbn', ':dbSearchPhrase'),
+            $qb->expr()->like('p.upc', ':dbSearchPhrase'),
+            $qb->expr()->like('p.mpn', ':dbSearchPhrase'),
+            $qb->expr()->like('p.reference', ':dbSearchPhrase'),
+            $qb->expr()->like('p.ean13', ':dbSearchPhrase'),
+            $qb->expr()->like('p.supplier_reference', ':dbSearchPhrase'),
 
             // Combination attributes
-            $qb->expr()->like('pa.isbn', $dbSearchPhrase),
-            $qb->expr()->like('pa.upc', $dbSearchPhrase),
-            $qb->expr()->like('pa.mpn', $dbSearchPhrase),
-            $qb->expr()->like('pa.reference', $dbSearchPhrase),
-            $qb->expr()->like('pa.ean13', $dbSearchPhrase),
-            $qb->expr()->like('pa.supplier_reference', $dbSearchPhrase)
+            $qb->expr()->like('pa.isbn', ':dbSearchPhrase'),
+            $qb->expr()->like('pa.upc', ':dbSearchPhrase'),
+            $qb->expr()->like('pa.mpn', ':dbSearchPhrase'),
+            $qb->expr()->like('pa.reference', ':dbSearchPhrase'),
+            $qb->expr()->like('pa.ean13', ':dbSearchPhrase'),
+            $qb->expr()->like('pa.supplier_reference', ':dbSearchPhrase')
         ));
+        $dbSearchPhrase = sprintf('%%%s%%', $searchPhrase);
+        $qb->setParameter(':dbSearchPhrase', $dbSearchPhrase);
 
         if (!empty($filters)) {
             foreach ($filters as $type => $filter) {

Other recommandations

  • Upgrade PrestaShop after 8.1.1