External risk intelligence

PrestaShop DPD France SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-25207

This vulnerability exists in a PrestaShop module designed for e-commerce integration. Such modules are typically deployed on public-facing web servers to handle shipping and logistics for online stores, making them directly reachable from the internet as part of the standard web application environment.

SQL Injection

Prestashop Dpd France

before 6.1.3

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a PrestaShop module, potentially impacting online stores using this e-commerce platform. The issue could allow unauthorized access and manipulation of data. The main concern is confirming relevance and exposure.

Module flaw allows dangerous data access.
Impacts online stores using the module.
Confirm relevance and understand exposure.

Attack Path

How an attacker could exploit the issue

An attacker can reach the vulnerable PrestaShop module via the web without any special access or authentication. By sending a crafted request to the `ajax.php` file, an attacker can trigger a SQL injection vulnerability. This could allow them to steal or modify sensitive data stored in the website's database.

Accessible via the internet.
Manipulates `ajax.php` with malicious input.
Allows database data theft or alteration.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the DPD France module for PrestaShop could allow an unauthenticated attacker to inject malicious SQL commands into the database via `ajax.php`. When this module is used, sensitive information stored within the PrestaShop database, such as customer details or order information, could be compromised or manipulated.

Database contents at risk.
Exploitable via network requests.
Data theft or unauthorized modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical SQL injection vulnerability in a PrestaShop module likely impacts e-commerce sites. The first practical step is to identify all PrestaShop instances utilizing the DPD France module, determine their internet-facing exposure, and confirm business criticality and ownership. This information will guide the prioritization and planning of remediation efforts, which may involve coordination with vendors or platform teams.

Application and platform teams should own this issue.
Verify module usage and internet exposure first.
Plan and coordinate remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the PrestaShop DPD France module?

The DPD France module is a software extension for the PrestaShop e-commerce platform. It integrates shipping and logistics functionality directly into online stores, enabling merchants to manage deliveries and tracking for customer orders within their existing store management environment.

What does CVE-2023-25207 mean regarding SQL injection?

This CVE describes a SQL injection vulnerability, classified as CWE-89. This weakness occurs when a software component fails to properly filter user input before including it in database queries. In this case, an attacker can manipulate these queries to bypass security controls, potentially viewing or changing sensitive information stored in the store's database.

How is this vulnerability triggered?

An attacker triggers this flaw by sending a specially crafted request to the `ajax.php` file within the DPD France module. The vulnerability is not triggered by standard site navigation or routine administrative tasks; it requires the submission of malicious input designed to interact with the database in unauthorized ways.

Is my site relevant to this CVE?

Halo Surface Signal indicates that since this module is typically used for shipping logistics on public-facing e-commerce stores, it is generally reachable from the internet. If you operate a PrestaShop site with this module installed, it is considered potentially exposed because the affected file is accessible to remote network requests.

Do I need to take immediate action?

Your first step should be to confirm if your PrestaShop instance uses the DPD France module and determine if it is running a version earlier than 6.1.3. Once identified, coordinate with your technical or platform teams to manage the risk, prioritize the system for updates, and verify if the module can be safely patched or removed.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.