CVE-2023-34575

Vulnerability

The PrestaShop module "Opart Save Cart" (opartsavecart) up to version 2.0.7 contains an SQL injection vulnerability in the OpartSaveCartDefaultModuleFrontController::initContent() and OpartSaveCartDefaultModuleFrontController::displayAjaxSendCartByEmail() methods [1]. These methods construct SQL queries using unsanitized user input from Tools::getValue(), such as the opartCartId parameter, directly concatenated into the query string [1]. Affected versions are those before 2.0.8 [1]. Guest users can trigger the vulnerable code paths without authentication [1].

Exploitation

An attacker needs only network access to the PrestaShop instance; no authentication or user interaction is required [1]. The exploit sends an HTTP request to the vulnerable front controller methods, injecting malicious SQL payloads via parameters like opartCartId [1]. The attack can be concealed because the module's controller path may be hidden, resulting in only a generic "POST /" entry in conventional frontend logs [1]. With tools like mod_security AuditEngine, the attack can be traced [1].

Impact

Successful exploitation allows an attacker to execute arbitrary SQL commands on the database [1]. This can lead to obtaining admin access, removing data from the associated PrestaShop, copying sensitive data (e.g., tokens) to expose and hijack admin AJAX scripts, rewriting SMTP settings to hijack emails, and fully compromising confidentiality, integrity, and availability (CVSS v3.1 base score 9.8) [1].

Mitigation

The vulnerability is fixed in version 2.0.8 of the opartsavecart module [1]. Users should upgrade to this version immediately [1]. No workarounds are disclosed in the available reference [1]. The module is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.