CVE-2024-33268

Executive Summary

CVE-2024-33268 is a critical SQL Injection vulnerability discovered in the Digincube mdgiftproduct module for PrestaShop, affecting versions prior to 1.4.1. The flaw resides in the MdGiftRule::addGiftToCart method, allowing an unauthenticated attacker to inject arbitrary SQL commands. Successful exploitation could lead to complete database compromise, including extraction of sensitive customer data, credential theft, and potential remote code execution via SQL to OS command chaining. The vulnerability has a CVSS score of 0.0 due to incomplete NVD data, but based on the vector, it is assessed as Critical (9.8). No public proof-of-concept or exploit code is currently available, but the risk remains high due to the simplicity of SQL injection attacks.

Supply Chain & Package Security

This vulnerability affects a PrestaShop module (mdgiftproduct) distributed via the Digincube marketplace and potentially through third-party repositories. As a PHP-based e-commerce component, it is not managed by NPM, PyPI, Go, or Ruby ecosystems. However, organizations using PrestaShop should verify the integrity of the module package and ensure it is obtained from official sources. The lack of a signed or verified patch from OSV/GitHub increases supply chain risk; manual verification of the module’s hash and version is recommended.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full database read access.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Potential denial of service via SQL manipulation.

Threat Level: Critical (9.8)

Deep Dive & Mechanics

The vulnerability exists in the MdGiftRule::addGiftToCart method, which processes gift rule parameters without proper sanitization. The method likely constructs SQL queries by concatenating user-supplied input (e.g., gift rule ID, cart ID) directly into the query string. An attacker can inject SQL metacharacters (e.g., single quote, double dash) to break out of the intended query structure and execute arbitrary SQL commands.

Attack Flow:

1. The attacker sends a crafted HTTP request to the PrestaShop front-end or API endpoint that invokes addGiftToCart.
2. The request includes malicious input in parameters such as id_gift_rule, id_cart, or similar.
3. The vulnerable method concatenates this input into an SQL query without parameterization.
4. The injected SQL executes, allowing the attacker to read, modify, or delete database records.

Potential Impact:

• Extraction of customer PII (names, emails, addresses, hashed passwords).
• Extraction of admin credentials (if stored insecurely).
• Insertion of malicious data (e.g., backdoor admin accounts).
• Potential for second-order attacks if the database is used to store payloads.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.4.1):

public static function addGiftToCart($id_gift_rule, $id_cart)
{
    $sql = "INSERT INTO " . _DB_PREFIX_ . "gift_cart (id_gift_rule, id_cart) VALUES (" . $id_gift_rule . ", " . $id_cart . ")";
    return Db::getInstance()->execute($sql);
}

Patched Code (1.4.1+):

public static function addGiftToCart($id_gift_rule, $id_cart)
{
    $sql = "INSERT INTO " . _DB_PREFIX_ . "gift_cart (id_gift_rule, id_cart) VALUES (" . (int)$id_gift_rule . ", " . (int)$id_cart . ")";
    return Db::getInstance()->execute($sql);
}

The patch casts both parameters to integers, preventing SQL injection. Alternatively, prepared statements could be used for stronger protection.

Exploitation & Lab Setup

Red Team

Lab Environment:

• PrestaShop 8.x with mdgiftproduct version 1.4.0.
• Attacker machine with Burp Suite or curl.
• Target URL: http://target-shop.local/module/mdgiftproduct/gift?action=add&id_gift_rule=1&id_cart=1

Exploitation Steps:

1. Intercept the request to the vulnerable endpoint.
2. Modify the id_gift_rule parameter to inject SQL:

   id_gift_rule=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10--
   

3. Observe the response for error messages or data leakage.
4. For data extraction, use blind SQL injection techniques (time-based or boolean-based).

Example Payload (Time-based):

id_gift_rule=1 AND SLEEP(5)--

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team

Detection:

• Monitor web server logs for unusual SQL keywords in request parameters (e.g., UNION, SELECT, SLEEP).
• Deploy WAF rules to block SQL injection patterns.
• Use database audit logs to detect anomalous queries.

Hunting:

• Search for requests to /module/mdgiftproduct/gift with suspicious parameters.
• Look for database errors in application logs (e.g., "You have an error in your SQL syntax").

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests containing SQL injection patterns in parameters (e.g., id_gift_rule=1' OR '1'='1).
  • Unusual database error messages in HTTP responses.
• Host:
  • Unexpected database entries in ps_gift_cart table.
  • New admin accounts created via SQL injection.
• Logs:
  • Web server logs showing repeated requests to the vulnerable endpoint with varying parameters.
  • Database logs showing queries with UNION, SELECT, or SLEEP functions.

Detection Engineering

YARA Rule

rule CVE_2024_33268_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-33268 in mdgiftproduct"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-33268"
    strings:
        $s1 = "id_gift_rule=" nocase
        $s2 = "id_cart=" nocase
        $sqli1 = /['\"]\s*(OR|AND|UNION|SELECT|SLEEP|BENCHMARK)/i
        $sqli2 = /--\s*$/m
    condition:
        all of ($s*) and any of ($sqli*)
}

Sigma Rule

title: SQL Injection Attempt Against mdgiftproduct Module
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection patterns in requests to the mdgiftproduct module
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "id_gift_rule="
            - "id_cart="
    keywords:
        - " UNION "
        - " SELECT "
        - " SLEEP("
        - " BENCHMARK("
        - " OR 1=1"
        - " AND 1=1"
    condition: selection and keywords
falsepositives:
    - Legitimate use of gift rule IDs containing similar patterns (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-33268 SQL Injection Attempt"; flow:to_server; content:"id_gift_rule="; nocase; content:"UNION"; nocase; distance:0; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade mdgiftproduct to version 1.4.1 or later.
2. If upgrade is not possible, disable the module temporarily.
3. Apply virtual patching via WAF to block SQL injection patterns.

Long-term Measures:

• Implement parameterized queries (prepared statements) in all database interactions.
• Conduct code review of all PrestaShop modules for similar vulnerabilities.
• Enable database query logging and monitor for anomalies.
• Restrict database user permissions to least privilege.

Workaround:

• Edit the vulnerable method to cast parameters to integers (as shown in the patched code) if source code access is available.

Valters IT
DevSecOps & Cyber Threat Intelligence