CVE-2023-34576

Vulnerability

An SQL injection vulnerability exists in the updatepos.php script of the PrestaShop module "Opart Faq" (opartfaq) versions up to and including 1.0.3 [1]. The bug resides in an AJAX endpoint that performs a database update operation using unsanitized user-supplied parameters from $_POST['opartFaqIdProductPos'] and $key. The vulnerable call is Db::getInstance()->update('opartfaq_questions_products', array('position' => $value), 'id_product='.$_POST['opartFaqIdProductPos'].' AND id_opartfaq_questions='.$key); where both parameters are concatenated directly into the SQL query without type casting or parameterization [1]. This allows any guest visitor to trigger the injection with a trivial HTTP request [1].

Exploitation

An attacker can exploit this vulnerability remotely without authentication, special network position, or user interaction [1]. The attack vector is network, complexity is low, and no privileges are required [1]. To exploit, the attacker sends a crafted HTTP POST request to the updatepos.php endpoint with malicious values in opartFaqIdProductPos or $key parameters that break out of the intended SQL syntax and execute arbitrary SQL statements [1]. The simple addition of (int) type casting in the patch confirms that the original parameters were used unsanitized [1].

Impact

Successful exploitation grants the attacker the ability to run arbitrary SQL commands against the PrestaShop database [1]. This can lead to obtaining admin access, removing data, copying sensitive tables to expose tokens and unlock admin AJAX scripts, rewriting SMTP settings to hijack emails, and full compromise of confidentiality, integrity, and availability (CVSS 9.8 critical) [1]. The attacker can read, modify, or delete any data in the database, potentially taking over the entire PrestaShop instance [1].

Mitigation

The vulnerability is fixed in version 1.0.4 of the opartfaq module, released on 2018 (note: no semver versioning before 2018, so all previous versions should be updated) [1]. The fix casts $_POST['opartFaqIdProductPos'] and $key to integers using (int) before concatenation [1]. Users must upgrade to version 1.0.4 or later [1]. No workaround is described for unpatched installations; upgrading to the latest PrestaShop version is also recommended as it disables multiquery execution by default [1].