CVE-2025-69633

Executive Summary

CVE-2025-69633 is a critical unauthenticated SQL Injection vulnerability discovered in the PrestaShop Advanced Popup Creator (advancedpopupcreator) module, affecting versions 1.1.26 through 1.2.6. The flaw resides in the fromController parameter within the popup controller, which is passed unsanitized to SQL queries in the classes/AdvancedPopup.php file, specifically in the getPopups() and updateVisits() functions. This allows remote attackers to execute arbitrary SQL commands without authentication, potentially leading to full database compromise, data exfiltration, and server takeover. The vulnerability has been fixed in version 1.2.7.

Supply Chain & Package Security

This vulnerability affects a third-party PrestaShop module distributed via the PrestaShop Addons marketplace and potentially other channels. As a supply chain risk, any PrestaShop installation using an affected version of this module is at immediate risk. Organizations should verify the integrity of their module installations and ensure they are sourced from trusted vendors.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability is rated as Critical due to the lack of authentication requirements, low attack complexity, and the potential for full compromise of the database and underlying server.

Deep Dive & Mechanics

The vulnerability is a classic SQL Injection flaw in the PrestaShop Advanced Popup Creator module. The fromController parameter is accepted from user input (likely via GET or POST requests) and is directly concatenated into SQL queries without proper sanitization or parameterization.

The vulnerable code resides in classes/AdvancedPopup.php within two functions:

1. getPopups(): This function likely retrieves popup data based on the controller context. The fromController parameter is used to filter or select popups, and the unsanitized input allows an attacker to inject SQL commands.

2. updateVisits(): This function likely tracks popup visits. The fromController parameter is again used unsafely, allowing injection.

An attacker can craft a malicious HTTP request to the popup controller endpoint, injecting SQL commands via the fromController parameter. For example, a simple injection could be:

GET /index.php?fc=module&module=advancedpopupcreator&controller=popup&fromController=1' OR '1'='1

This would cause the SQL query to become:

SELECT * FROM `ps_advancedpopup` WHERE `controller` = '1' OR '1'='1'

This would return all popups, but more sophisticated injections can be used to extract data, modify records, or execute system commands via INTO OUTFILE or similar techniques.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.2.6):

In classes/AdvancedPopup.php, the fromController parameter is used directly in SQL queries:

// Vulnerable example (conceptual)
public function getPopups($fromController) {
    $sql = "SELECT * FROM `" . _DB_PREFIX_ . "advancedpopup` WHERE `controller` = '" . $fromController . "'";
    return Db::getInstance()->executeS($sql);
}

Patched Code (version 1.2.7):

The patched version uses prepared statements or proper escaping to prevent injection:

// Patched example (conceptual)
public function getPopups($fromController) {
    $sql = "SELECT * FROM `" . _DB_PREFIX_ . "advancedpopup` WHERE `controller` = '" . pSQL($fromController) . "'";
    return Db::getInstance()->executeS($sql);
}

The pSQL() function in PrestaShop escapes special characters, preventing SQL injection. Alternatively, the module may use parameterized queries.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Setup: Deploy a vulnerable PrestaShop instance with the Advanced Popup Creator module version 1.2.6 or earlier.

2. Reconnaissance: Identify the vulnerable endpoint. Typically, it is accessible via:

   http://target.com/index.php?fc=module&module=advancedpopupcreator&controller=popup
   

3. Exploitation: Use a tool like sqlmap or manual injection to exploit the fromController parameter.

   Manual Injection Example:

   GET /index.php?fc=module&module=advancedpopupcreator&controller=popup&fromController=1' UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -
   

   Automated with sqlmap:

   sqlmap -u "http://target.com/index.php?fc=module&module=advancedpopupcreator&controller=popup&fromController=1" --batch --dbs
   

4. Post-Exploitation: Once SQL injection is confirmed, extract database contents, including admin credentials, customer data, and configuration details. Attempt to gain shell access via INTO OUTFILE if the database user has file write privileges.

Blue Team (Detection & Response)

1. Monitor Web Logs: Look for suspicious patterns in access logs, especially requests to the popup controller with unusual fromController values.
2. WAF Rules: Deploy Web Application Firewall (WAF) rules to block SQL injection attempts.
3. Database Monitoring: Monitor database query logs for unexpected or anomalous queries.
4. Incident Response: If exploitation is detected, immediately isolate the affected server, rotate all credentials, and restore from a known good backup after patching.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /index.php?fc=module&module=advancedpopupcreator&controller=popup with suspicious fromController parameters (e.g., containing SQL keywords like UNION, SELECT, OR, --).
  • Unusual outbound database connections or data transfers.
• File IOCs:
  • Unexpected files in the web root (e.g., .php shells).
  • Modified or new entries in PrestaShop configuration tables.
• Log IOCs:
  • Database error logs showing SQL syntax errors.
  • Web server access logs with repeated requests to the vulnerable endpoint.

Detection Engineering

YARA Rule

rule Detect_AdvancedPopupCreator_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-69633 in PrestaShop Advanced Popup Creator"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-69633"
    strings:
        $s1 = "advancedpopupcreator" nocase
        $s2 = "fromController" nocase
        $s3 = "UNION" nocase
        $s4 = "SELECT" nocase
        $s5 = "OR" nocase
        $s6 = "1=1" nocase
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5, $s6)
}

Sigma Rule

title: SQL Injection Attempt Against PrestaShop Advanced Popup Creator
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects SQL injection attempts targeting the fromController parameter in the Advanced Popup Creator module.
author: Valters IT
date: 2025/04/10
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69633
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - "advancedpopupcreator"
            - "fromController"
        cs-uri-query|contains|all:
            - "SELECT"
            - "UNION"
            - "OR"
    condition: selection
falsepositives:
    - Legitimate use of the module with normal parameters
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-69633 SQL Injection Attempt - PrestaShop Advanced Popup Creator"; flow:to_server,established; content:"advancedpopupcreator"; http_uri; content:"fromController"; http_uri; pcre:"/(SELECT|UNION|OR|1=1)/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade the Advanced Popup Creator module to version 1.2.7 or later.
2. Workaround: If immediate patching is not possible, disable the module entirely or restrict access to the popup controller via .htaccess or web server configuration.
3. WAF Rules: Implement virtual patching using a WAF to block SQL injection attempts targeting the fromController parameter.
4. Input Validation: Ensure all user-supplied input is properly sanitized and parameterized in custom code.
5. Least Privilege: Ensure the database user used by PrestaShop has minimal necessary privileges (e.g., no FILE privilege).
6. Monitoring: Continuously monitor for exploitation attempts and anomalous database activity.

Valters IT