Description
Authenticated SQL injection in the productcomments module
Impact
An authenticated SQL injection (CWE-89) affects the official productcomments module up to and including version 8.0.0.
When a review criterion is saved from the module configuration page, the submitted category and product identifiers are inserted into SQL queries without sanitization or parameter binding, allowing arbitrary SQL to be injected.
Exploitation requires a back-office employee account with access to the module configuration page; full administrator privileges are not required. A successful attack allows the shop database to be read or modified.
Patches
The problem is patched in productcomments 8.0.1. Both updateCategories() and updateProducts() now use bound parameters and cast the IDs to integers.
Users of productcomments 8.0.0 or earlier should upgrade the module to 8.0.1.
Workarounds
If upgrading immediately is not possible and you want to patch your module manually, you'll find the required modification in this commit:
The only modified file being src/Repository/ProductCommentCriterionRepository.php
Credits
Reported by Jean-Jamil Khalife (HDWSec : https://hdwsec.fr )
Original text by GitHub Security Advisory, licenseCC BY 4.0.
CVSS metrics 3.1
Source: github.com · secondaryCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HReferences
Found a vulnerability?
Write to the PrestaShop core security team:
security-core@prestashop.com