CVE-2022-31101: Prestashop Blockwishlist SQLi Vulnerability

CVE-2022-31101 Overview

CVE-2022-31101 is a SQL Injection vulnerability affecting the PrestaShop Blockwishlist extension, a popular e-commerce module that enables customers to create and manage product wishlists. The vulnerability allows authenticated customers to perform SQL injection attacks against the underlying database, potentially leading to unauthorized data access, modification, or complete database compromise.

Critical Impact

Authenticated users can exploit this SQL injection vulnerability to extract sensitive customer data, modify database contents, or potentially escalate attacks to achieve remote code execution on affected PrestaShop installations.

Affected Products

• PrestaShop Blockwishlist versions prior to 2.1.1
• PrestaShop e-commerce installations using vulnerable Blockwishlist module
• Online stores with customer wishlist functionality enabled

Discovery Timeline

• 2022-06-27 - CVE-2022-31101 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-31101

Vulnerability Analysis

This SQL injection vulnerability exists in the Blockwishlist extension's product search functionality, specifically within the WishListProductSearchProvider.php component. The flaw stems from insufficient input validation and sanitization of user-supplied parameters before they are incorporated into SQL queries.

The vulnerability requires authentication, meaning an attacker must have a valid customer account on the PrestaShop store. However, since customer registration is typically open on e-commerce platforms, this presents a low barrier to exploitation. Once authenticated, an attacker can craft malicious input through the wishlist functionality to inject arbitrary SQL commands into database queries.

Successful exploitation could allow attackers to bypass application-level security controls, extract sensitive information from the database (including customer credentials, payment information, and order details), modify or delete data, and potentially achieve further system compromise depending on database configuration and privileges.

Root Cause

The root cause of CVE-2022-31101 is improper input validation in the wishlist product search functionality. The vulnerable code fails to properly validate user input before incorporating it into SQL queries, violating secure coding principles around parameterized queries and input sanitization.

The security patch addresses this by introducing the Validate class for proper input validation:

 use Product;
 use Shop;
 use Symfony\Component\Translation\TranslatorInterface;
+use Validate;
 use WishList;

 /**

Source: GitHub Commit Update

The fix introduces proper validation through PrestaShop's Validate utility class, ensuring user input is sanitized before being used in database operations.

Attack Vector

The attack is network-based and can be executed remotely by any authenticated customer. The attacker creates or logs into a customer account, navigates to wishlist functionality, and injects malicious SQL syntax through vulnerable input fields or API parameters. The low complexity of exploitation combined with the availability of public exploit information on ExploitDB increases the risk profile for unpatched installations.

Detection Methods for CVE-2022-31101

Indicators of Compromise

• Unusual SQL error messages in web server logs originating from wishlist-related endpoints
• Abnormal database queries containing SQL syntax characters (single quotes, UNION statements, OR 1=1 patterns) in wishlist parameters
• Unexpected database access patterns from customer-associated sessions
• Evidence of data exfiltration or unauthorized database reads in audit logs

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect SQL injection patterns in HTTP requests targeting /module/blockwishlist/ endpoints
• Monitor application logs for SQL syntax errors or database exceptions related to wishlist functionality
• Deploy database activity monitoring to detect anomalous query patterns or unauthorized data access
• Review PrestaShop module versions and cross-reference against known vulnerable versions (prior to 2.1.1)

Monitoring Recommendations

• Enable detailed logging for the Blockwishlist module and related database operations
• Configure alerting for multiple failed database queries or SQL errors from single customer sessions
• Implement rate limiting on wishlist API endpoints to slow potential exploitation attempts
• Regularly audit installed PrestaShop modules against the GitHub Security Advisory

How to Mitigate CVE-2022-31101

Immediate Actions Required

• Upgrade PrestaShop Blockwishlist module to version 2.1.1 or later immediately
• If immediate patching is not possible, consider temporarily disabling the Blockwishlist module
• Audit database access logs for any signs of previous exploitation
• Review customer accounts for suspicious activity or unauthorized data access
• Implement WAF rules to block common SQL injection attack patterns

Patch Information

PrestaShop has released version 2.1.1 of the Blockwishlist module which addresses this vulnerability. The fix is available through the official PrestaShop addons marketplace and the GitHub repository commit. The patch introduces proper input validation using PrestaShop's Validate class to sanitize user input before database operations.

Administrators should update through the PrestaShop back office module manager or manually download and install the patched version from the official repository.

Workarounds

• There are no official workarounds provided by the vendor for this vulnerability
• As a temporary measure, disable the Blockwishlist module entirely until patching is possible
• Implement strict WAF rules to filter SQL injection patterns on wishlist endpoints
• Restrict wishlist functionality to trusted user groups if business requirements allow

# Configuration example - Disable module via PrestaShop CLI
php bin/console prestashop:module disable blockwishlist

# Verify current module version
php bin/console prestashop:module list | grep blockwishlist

# Update module to patched version
php bin/console prestashop:module upgrade blockwishlist