CVE-2024-25847

Executive Summary

CVE-2024-25847 is a critical SQL Injection vulnerability discovered in the MyPrestaModules "Product Catalog (CSV, Excel) Import" module (simpleimportproduct) for PrestaShop. The flaw resides in the Send::__construct() and importProducts::_addDataToDb methods, allowing an unauthenticated attacker to inject arbitrary SQL queries. Successful exploitation can lead to privilege escalation within the PrestaShop admin panel and the exfiltration of sensitive data, including customer credentials, order details, and database credentials. The vendor has not released a patch, and no public exploit code is available at this time.

CVSS Breakdown & Threat Level

While a CVSS vector is not officially assigned, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the database.
• Confidentiality (C): High (H) – Full database read access.
• Integrity (I): High (H) – Ability to modify/delete data.
• Availability (A): High (H) – Potential for denial of service via destructive queries.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The lack of a patch and the potential for full database compromise make this a high-priority vulnerability for any PrestaShop instance using this module.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection within the simpleimportproduct module. The module is designed to import product data from CSV or Excel files. The injection occurs in two key methods:

1. Send::__construct(): This constructor likely handles the initial parsing of import file headers or configuration parameters. User-supplied input from the import file (e.g., column names, delimiter settings) is directly concatenated into SQL queries without sanitization or parameterization.

2. importProducts::_addDataToDb(): This method is responsible for inserting the parsed product data into the database. The values from the imported file are likely used directly in INSERT or UPDATE statements, allowing an attacker to craft a malicious CSV/Excel file that, when processed, injects SQL commands.

The attack flow is:

1. An attacker crafts a malicious CSV or Excel file containing SQL injection payloads in one or more fields (e.g., product name, description, price).
2. The attacker uploads this file via the module's import functionality (typically accessible to admin users, but potentially exposed to unauthenticated users if the module has insecure access controls).
3. The module processes the file, and the unsanitized payload is executed against the PrestaShop database.
4. The attacker can then extract data, create admin accounts, or execute arbitrary SQL commands.

Vulnerable vs. Patched Code

Since no patch is available, a direct comparison is not possible. However, the vulnerable code pattern would look like this:

Vulnerable Code (Conceptual PHP):

// In Send::__construct()
$column_name = $_POST['column_name']; // Unsanitized input
$sql = "SELECT * FROM "._DB_PREFIX_."product WHERE name = '$column_name'";
Db::getInstance()->execute($sql);

// In importProducts::_addDataToDb()
$product_name = $row['name']; // From CSV file
$sql = "INSERT INTO "._DB_PREFIX_."product (name) VALUES ('$product_name')";
Db::getInstance()->execute($sql);

Patched Code (Conceptual PHP):

// In Send::__construct()
$column_name = pSQL($_POST['column_name']); // Sanitized with PrestaShop's pSQL function
$sql = "SELECT * FROM "._DB_PREFIX_."product WHERE name = '$column_name'";
Db::getInstance()->execute($sql);

// In importProducts::_addDataToDb()
$product_name = pSQL($row['name']); // Sanitized
$sql = "INSERT INTO "._DB_PREFIX_."product (name) VALUES ('$product_name')";
Db::getInstance()->execute($sql);

The fix involves using PrestaShop's built-in pSQL() function (or prepared statements) to escape special characters and prevent SQL injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Since no public exploit exists, a proof-of-concept can be developed. The attacker would need access to the import functionality.

Step 1: Craft Malicious CSV Create a CSV file with a payload in a vulnerable field. For example, in the name column:

name,price,description
"test' UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -",10.00,"A test product"

Step 2: Upload and Trigger Upload the CSV via the module's import interface. The injected SQL will be executed.

Step 3: Data Exfiltration Use a blind SQL injection technique or error-based injection to extract data. For example, using LOAD_FILE() or INTO OUTFILE to write data to a web-accessible directory.

Example Payload for Admin Creation (if permissions allow):

'; INSERT INTO ps_employee (firstname, lastname, email, passwd, id_profile, active) VALUES ('hacker', 'hacker', 'hacker@example.com', MD5('password123'), 1, 1); --

Blue Team (Detection & Hardening)

1. Disable the Module: Immediately disable the simpleimportproduct module if it is not essential.
2. Web Application Firewall (WAF): Deploy WAF rules to block common SQL injection patterns in POST parameters and file uploads.
3. Database Monitoring: Monitor database logs for unusual queries, especially UNION, SELECT, INSERT, and DROP statements originating from the web application user.
4. Input Validation: Ensure all file uploads are validated for content type and size. Implement strict input sanitization on the server side.
5. Least Privilege: Ensure the database user used by PrestaShop has minimal privileges (e.g., no FILE, CREATE, or DROP privileges).

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /modules/simpleimportproduct/ with unusually large or malformed CSV/Excel file uploads.
  • SQL error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
• File System IOCs:
  • Unexpected CSV or Excel files in the /upload/ or /modules/simpleimportproduct/ directories.
  • New PHP files in web-accessible directories (webshells).
• Database IOCs:
  • New or modified admin accounts in ps_employee table.
  • Unusual queries in the MySQL general log or slow query log.
  • Unexpected data in ps_connections or ps_connections_page tables.

Detection Engineering

YARA Rule

rule CVE_2024_25847_SimpleImportProduct_SQLi {
    meta:
        description = "Detects malicious CSV/Excel files targeting CVE-2024-25847"
        author = "Valters IT"
        date = "2024-03-15"
        reference = "CVE-2024-25847"
    strings:
        $sqli1 = /'.*UNION.*SELECT.*--/ nocase
        $sqli2 = /'.*INSERT.*INTO.*ps_/ nocase
        $sqli3 = /'.*DROP.*TABLE.*/ nocase
        $sqli4 = /'.*LOAD_FILE.*/ nocase
        $sqli5 = /'.*INTO.*OUTFILE.*/ nocase
    condition:
        any of ($sqli*) and (filetype == "CSV" or filetype == "XLS" or filetype == "XLSX")
}

Sigma Rule

title: SQL Injection via SimpleImportProduct Module
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts targeting the MyPrestaModules SimpleImportProduct module
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/modules/simpleimportproduct/*'
        cs-uri-query|contains: 
            - 'UNION'
            - 'SELECT'
            - 'INSERT'
            - 'DROP'
            - 'LOAD_FILE'
            - 'INTO OUTFILE'
    condition: selection
falsepositives:
    - Legitimate use of SQL keywords in product names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-25847 SQL Injection Attempt - SimpleImportProduct"; flow:to_server,established; content:"POST"; http_method; content:"/modules/simpleimportproduct/"; http_uri; pcre:"/(UNION|SELECT|INSERT|DROP|LOAD_FILE|INTO OUTFILE)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the simpleimportproduct module until a patch is released.
2. Vendor Contact: Contact MyPrestaModules for an official patch or update.
3. Alternative Solution: Consider using a different, actively maintained import module.
4. Code-Level Fix (if you have access): Apply the conceptual patch described in the "Vulnerable vs. Patched Code" section. Use pSQL() or prepared statements for all database queries.
5. Long-Term: Implement a Web Application Firewall (WAF) and conduct regular security audits of all third-party modules.

Valters IT