CVE-2023-45375 Scanner

The PrestaShop PireosPay is a module designed for integration with the PrestaShop platform, facilitating payment processes. This module is commonly used by e-commerce stores utilizing PrestaShop to manage transactions securely and efficiently. With the ability to handle multiple transactions, it is favored across various sectors that require online payment functionalities. The software aims to simplify the transaction process for merchants while maintaining security and user friendliness. Its ease of integration and configuration makes it a popular choice among small to medium-sized enterprises seeking to optimize their payment systems. The flexibility offered by this module aids businesses in maintaining smooth financial operations without compromising on security.

SQL Injection is a prevalent vulnerability that allows an attacker to interfere with the queries that an application makes to its database. This vulnerability can permit unauthorized actions on the database, such as accessing sensitive information, modifying data, or executing administrative operations. SQL Injection vulnerabilities are among the oldest and most dangerous web application security threats. The impact of this vulnerability can vary depending on the database backend and the privileges of the database user. Exploiting SQL Injection could lead to data breaches and compromises of business-critical information. Proper validation and sanitization of database requests are crucial to prevent such vulnerabilities.

The PrestaShop PireosPay module is vulnerable at its validation endpoint where a time-based SQL Injection attack can be conducted. An attacker may manipulate specific POST requests, as seen in the 'MerchantReference' parameter, allowing for the execution of arbitrary SQL commands. The vulnerability is demonstrated with a crafted SQL input that includes sleep functions, which confirm SQL injection through observable delay patterns. The SQL Injection occurs due to insufficient validation and escaping of user-supplied input. This flaw allows attackers to execute queries and extract or manipulate data from the database. The vulnerability highlights the importance of using parameterized queries to prevent such attacks.

When successfully exploited, this SQL Injection vulnerability allows attackers to gain unauthorized access to the database, potentially leading to full data compromise. Sensitive customer information such as personal and financial data could be exposed to malicious actors. Beyond data theft, the attacker could modify or delete critical business data, disrupt operations, or deploy further exploits. This breach can significantly impact an organization's reputation and customer trust. Financial repercussions might follow due to the breach of data protection regulations, leading to fines and lawsuits. It underscores the need for stringent security measures to safeguard against data manipulation vulnerabilities.

REFERENCES

• https://security.friendsofpresta.org/modules/2023/10/12/pireospay.html
• https://github.com/fkie-cad/nvd-json-data-feeds