External risk intelligence

PrestaShop Posrotatorimg Module SQL Injection

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-45379

This vulnerability affects a module for PrestaShop, a widely used e-commerce platform. Plugins and modules for such platforms are typically deployed on public-facing web servers to facilitate customer interaction and store operations, making the vulnerable code segment directly accessible over the internet.

SQL Injection

Posthemes Posrotatorimg

1.1 and earlier

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability exists in a PrestaShop module called "Rotator Img," which allows unauthorized SQL injection. This could potentially lead to unauthorized access and manipulation of your e-commerce data.

Guest users can inject malicious SQL code.
Critical risk to e-commerce data integrity and availability.
Confirm relevance and understand potential data exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted requests to a PrestaShop website that uses the "Rotator Img" module. This allows them to directly interact with the vulnerable component without needing any special access or authentication. By manipulating the input to the module, an attacker can execute arbitrary SQL commands on the website's database.

No authentication required.
Guest can trigger SQL injection.
Full database compromise possible.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an unauthenticated user could execute arbitrary SQL commands by sending specially crafted requests to the "Rotator Img" module. This could lead to unauthorized access to and manipulation of the underlying database, potentially exposing sensitive information.

Database integrity and confidentiality at risk.
Via specially crafted network requests.
Unauthorized data access and modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects the "Rotator Img" module for PrestaShop. The first practical move is for the platform or application owner to identify all instances of this module, confirm its reachability and business criticality, and then initiate a risk-based remediation plan.

Platform/application owners should own this issue.
Verify module presence and reachability first.
Plan remediation based on confirmed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the posrotatorimg module for PrestaShop?

The posrotatorimg module, or "Rotator Img," is a third-party add-on used in the PrestaShop e-commerce platform. It provides specialized functionality to rotate or display images on a store's storefront. Because it is designed to enhance customer-facing pages, it resides within the web application's structure to ensure users can view these images while browsing products.

How does CVE-2023-45379 cause a SQL injection vulnerability?

This vulnerability is classified as CWE-89, or Improper Neutralization of Special Elements used in an SQL Command. In plain terms, the module fails to properly filter or clean data provided by users before including it in database queries. This allows an attacker to insert their own database commands into the module, tricking the system into executing unauthorized instructions against the underlying database.

Do I need special access to trigger this SQL injection?

No. The vulnerability does not require an attacker to have an account or administrative permissions on the website. A guest user can initiate the attack simply by sending a specially crafted network request to the vulnerable component. If the request reaches the module, the system processes it as if it were legitimate, which is why standard site access is sufficient for exploitation.

Why does Halo Surface Signal categorize this as an external threat?

Halo Surface Signal flags this as an external threat because PrestaShop modules are typically installed on web servers meant to be reached by customers over the internet. Since this module is part of the public-facing storefront, the vulnerable code is accessible to anyone on the web, significantly increasing the likelihood that it can be reached by unauthorized parties compared to internal-only software.

What is the first step to address this module vulnerability?

Your initial priority should be to create an inventory of your PrestaShop environment to confirm if the posrotatorimg module is installed and active. Once you have identified where the module is running, assess its importance to your business operations. After confirming the module's presence and business impact, coordinate with your technical team to develop a remediation plan to secure your database against potential unauthorized access.

References

security.friendsofpresta.org/modules/2023/10/17/posrotatorimg.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.