CVE-2024-36683: PrestaShop Products Alert SQL Injection

CVE-2024-36683 Overview

CVE-2024-36683 is a SQL injection vulnerability affecting the "Products Alert" (productsalert) module before version 1.7.4 from Smart Modules for PrestaShop. This vulnerability allows remote attackers to obtain sensitive information and cause other impacts by exploiting improper input handling in the ProductsAlertAjaxProcessModuleFrontController::initContent method.

Critical Impact

Unauthenticated attackers can exploit this SQL injection vulnerability over the network to extract sensitive database information, potentially compromising customer data, credentials, and other confidential information stored in the PrestaShop database.

Affected Products

• Products Alert (productsalert) module versions prior to 1.7.4
• PrestaShop installations using the vulnerable Smart Modules Products Alert extension
• E-commerce platforms running unpatched versions of the productsalert module

Discovery Timeline

• June 20, 2024 - Security advisory published by Friends of Presta
• June 24, 2024 - CVE-2024-36683 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2024-36683

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) exists in the Products Alert module's front controller. The vulnerability is classified as a classic SQL injection flaw where user-supplied input is incorporated into SQL queries without proper sanitization or parameterization. The attack can be executed remotely over the network without requiring authentication, and exploiting the vulnerability does not require complex conditions or user interaction.

The vulnerability impacts confidentiality, integrity, and availability of the affected system, allowing attackers to read sensitive data, modify database contents, and potentially disrupt service availability through malicious SQL operations.

Root Cause

The root cause of this vulnerability lies in the ProductsAlertAjaxProcessModuleFrontController::initContent method, which fails to properly sanitize user-controlled input before incorporating it into SQL queries. This lack of input validation allows attackers to inject arbitrary SQL commands that are then executed against the backend database with the privileges of the database user configured for the PrestaShop application.

PrestaShop modules that don't utilize the platform's built-in parameterized query mechanisms or fail to properly escape user input are susceptible to this class of vulnerability.

Attack Vector

The attack is executed remotely over the network by sending specially crafted HTTP requests to the vulnerable AJAX controller endpoint. Since no authentication is required, any remote attacker can target vulnerable PrestaShop installations. The attack flow typically involves:

1. Identifying PrestaShop installations with the vulnerable productsalert module
2. Crafting malicious input containing SQL injection payloads
3. Sending requests to the ProductsAlertAjaxProcessModuleFrontController endpoint
4. Extracting sensitive data through error-based, blind, or time-based SQL injection techniques

The vulnerability can be exploited to extract database contents including customer records, administrative credentials, order information, and other sensitive e-commerce data. For detailed technical information about the exploitation vectors, refer to the Friends of Presta Security Advisory.

Detection Methods for CVE-2024-36683

Indicators of Compromise

• Unusual database queries or errors in PrestaShop application logs related to the productsalert module
• HTTP requests to productsalert AJAX endpoints containing SQL metacharacters such as single quotes, double dashes, or UNION statements
• Evidence of data exfiltration through time-based SQL injection patterns with extended response times
• Unexpected database activity or queries executing against sensitive tables

Detection Strategies

• Deploy Web Application Firewalls (WAF) with SQL injection detection rules targeting PrestaShop endpoints
• Monitor HTTP access logs for requests containing SQL injection patterns targeting the productsalert controller
• Implement database activity monitoring to detect anomalous query patterns or unauthorized data access
• Review PrestaShop error logs for SQL syntax errors that may indicate injection attempts

Monitoring Recommendations

• Enable verbose logging for the PrestaShop application and productsalert module
• Configure alerts for database queries containing suspicious SQL keywords from web-facing controllers
• Monitor for bulk data extraction patterns that could indicate successful exploitation
• Implement network-level monitoring for unusual outbound traffic from the database server

How to Mitigate CVE-2024-36683

Immediate Actions Required

• Update the Products Alert (productsalert) module to version 1.7.4 or later immediately
• If immediate patching is not possible, disable or remove the productsalert module until the update can be applied
• Review database access logs for any evidence of exploitation prior to patching
• Reset database credentials and administrative passwords if compromise is suspected

Patch Information

The vulnerability has been addressed in Products Alert module version 1.7.4 released by Smart Modules. Administrators should update to this version or later through the PrestaShop module management interface or by obtaining the update directly from the vendor. For complete details on the security fix, consult the Friends of Presta Security Advisory.

Workarounds

• Temporarily disable the Products Alert module by removing it from active modules in PrestaShop's back office
• Implement WAF rules to block requests containing SQL injection patterns targeting productsalert endpoints
• Restrict network access to the PrestaShop administrative and AJAX endpoints using firewall rules
• Apply the principle of least privilege to database user accounts used by PrestaShop

# Disable the module via PrestaShop CLI (if available)
php bin/console prestashop:module disable productsalert

# Or manually remove the module directory (backup first)
mv /var/www/html/prestashop/modules/productsalert /var/www/html/prestashop/modules/productsalert.disabled