CVE-2023-46347 Scanner

The PrestaShop Step by Step products Pack is used by e-commerce websites to enhance product display for customers. It is developed by NDK Design and aims to provide better user experiences on online stores based on PrestaShop. This module allows site owners to implement step-by-step product navigation, which is particularly useful for complex product offerings. The software is employed by various small to medium-sized enterprises who rely on PrestaShop for managing their online sales. Users benefit from its integration capabilities with the PrestaShop platform. Overall, it is a supplement to enrich the functionality provided by PrestaShop’s core offerings.

The vulnerability identified is an SQL Injection issue within the PrestaShop Step by Step products Pack module. This type of vulnerability allows attackers to interfere with the queries that an application makes to its database. By injecting malicious SQL statements, attackers can potentially view, modify, or delete data in the database. The specific vulnerability exists in affected versions up to 1.5.6, where inadequate input validation occurs. This security flaw could be leveraged by remote attackers without authentication. The high severity of this vulnerability reflects its ability to potentially compromise data confidentiality, integrity, and availability.

Technically, the vulnerability stems from the “search-result.php” script within the module, where user inputs are not properly sanitized. Crafted requests can manipulate the SQL query through the "search_query" parameter. The current logic fails to prevent malicious SQL commands from being executed against the backend database. Remote attackers may leverage this by tricking the application into executing arbitrary SQL commands. This can include executing a series of commands by using SQL syntax like `select` and `execute`. Defending against this requires code-level changes in input validation and database query handling.

If exploited, this vulnerability can allow unauthorized access to sensitive data stored in the database. Attackers might exfiltrate customer information, transaction details, and other critical business data. It could also result in attackers tampering with or deleting data, disrupting the normal operation of affected systems. The successful exploitation of this issue could further lead to secondary attacks, such as deploying additional payloads that cause data corruption. In severe scenarios, this vulnerability could be used as an entry point for broader compromises across the PrestaShop installation.

REFERENCES

• https://security.friendsofpresta.org/modules/2023/10/24/ndk_steppingpack.html
• https://stack.chaitin.com/poc/detail/3977