CVE-2022-44727 Scanner

The PrestaShop lgcookieslaw module is extensively used in e-commerce platforms to help store owners comply with EU Cookie Law GDPR by managing user consent through banners and blockers. It is a module integrated within PrestaShop, an open-source e-commerce solution frequently adopted by businesses for setting up online stores. This module tracks and stores user consent choices using cookies, which assist businesses in legally interacting with users regarding cookies. Often the module is updated to comply with the latest regulations concerning data privacy for EU citizens. Online stores significantly rely on this module to manage consent seamlessly while maintaining adherence to regulatory standards.

The discovered vulnerability in the PrestaShop lgcookieslaw module is a blind SQL injection flaw. It allows threat actors to exploit the user consent storage cookies (__lglaw or lgcookieslaw) to execute arbitrary SQL commands. This injection vulnerability could potentially be used to extract or manipulate database contents, thus compromising data integrity and confidentiality. The lack of input sanitization in the module before version 2.1.3 proves to be the root cause of this severe security weakness.

The vulnerability is embedded in the module where cookies are utilized without adequate validation, specifically the __lglaw or lgcookieslaw cookies storing user consent. Attackers can leverage the flaw using crafted HTTP requests containing malicious strings that perform SQL operations. Exploiting this vulnerability may result in unauthorized data alteration or data theft, and threats are exacerbated given its unauthenticated access nature.

Upon successful exploitation, malicious actors can read or alter sensitive data within the PrestaShop database. This breach can lead to the exposure of personal identifiable information (PII) of customers, such as their names and addresses, or even more critical information like payment-related data. The integrity of the entire database is at risk, potentially leading to data corruption, loss of customer trust, and financial issues due to the tampering of transactional records.

REFERENCES

• https://nvd.nist.gov/vuln/detail/CVE-2022-44727
• https://security.friendsofpresta.org/modules/2022/11/06/lgcookieslaw.html
• https://web.archive.org/web/2/https://securityandstuff.com/posts/cve-2022-44727/