External risk intelligence

PrestaShop cdesigner SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-30191

This vulnerability affects a module within PrestaShop, an e-commerce platform designed to be a public-facing web application. Since the vulnerable component is part of the front-end controller of an online store, it is commonly exposed to the public internet to facilitate site functionality and visitor interactions.

SQL Injection

Cdesigner Project Cdesigner

3.2.2 and earlier

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical security flaw in a module for the PrestaShop e-commerce platform that allows for SQL injection. This means an attacker could potentially manipulate database queries to access or alter sensitive information stored within the online store. The main concern at this time is confirming if this module is used and exposed.

Critical flaw in e-commerce platform module.
Could expose sensitive online store data.
Confirm relevance and exposure of the module.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to a PrestaShop website that has the vulnerable cdesigner module installed. This could allow them to manipulate database queries, potentially leading to unauthorized access to sensitive information or complete compromise of the website.

No authentication required.
Triggered via a specific web request.
Risk of data theft and site control.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could allow an unauthenticated attacker to inject malicious SQL code into the application through the `CdesignerTraitementModuleFrontController::initContent()` function. This could potentially lead to unauthorized access to, modification of, or deletion of sensitive data stored within the PrestaShop database.

Database contents could be compromised.
Attacker may inject SQL via a crafted request.
Data exposure or modification may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in the `cdesigner` module affects PrestaShop deployments. The first practical step is for the e-commerce platform owner or the PrestaShop infrastructure team to identify all instances of the `cdesigner` module, confirm its reachability and business criticality, and then coordinate with the module vendor or development team for remediation.

E-commerce platform owners.
Verify `cdesigner` module deployment.
Plan vendor-coordinated remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the cdesigner module for PrestaShop?

Cdesigner is a third-party add-on module for PrestaShop, a popular open-source e-commerce platform. Users install modules like this to extend their online store's functionality, such as adding design customization tools or specific administrative features to their shop's interface.

What does SQL injection mean for CVE-2023-30191?

This vulnerability is classified as CWE-89, or Improper Neutralization of Special Elements used in an SQL Command. In plain terms, the module fails to properly filter user input before using it in database queries. An attacker can exploit this weakness to 'inject' their own malicious SQL commands, potentially tricking the website's database into revealing, modifying, or deleting sensitive information.

How is this vulnerability triggered?

An attacker triggers this flaw by sending a specially crafted web request to the vulnerable controller function within the cdesigner module. Because this function is designed to handle front-end interactions, it does not require the attacker to have an existing user account or administrative credentials to execute the malicious commands.

Do I need to worry about this if my store is internal?

According to Halo Surface Signal, this vulnerability is most concerning for public-facing web applications. Since cdesigner operates within the front-end controller of an online store, it is typically accessible over the internet to enable visitor interactions. If your specific instance of this module is not exposed to the public internet, the practical risk is significantly reduced.

What should I do if I am running this module?

Your first step is to perform an inventory of your PrestaShop modules to confirm if cdesigner is installed and active. Once you have identified all instances, assess whether the module is necessary for your current business operations. Coordinate with your development team or the module vendor to apply available updates or remove the component if it is no longer required.

References

friends-of-presta.github.io/security-advisories/modules/2023/05/17/cdesigner-89.h…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.