Description
PrestaShop 的 xipblog 模块中存在 SQL 注入漏洞，特别是在 2.0.1 及更早版本中。此漏洞使远程攻击者能够利用 xipcategoryclass 和 xippostsclass 组件，从而可能使他们能够提升权限并执行未经授权的数据库查询。没有采取足够的输入验证措施，因此用户更新其安装以降低风险至关重要。
PrestaShop /module/xipblog/archive SQL 注入漏洞（CVE-2023-27847）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://security.friendsofpresta.org/modules/2023/03/23/xipblog.html
https://nvd.nist.gov/vuln/detail/CVE-2023-27847
https://www.cvedetails.com/cve/CVE-2023-27847/
https://blog.sorcery.ie/posts/xipblog_sqli/
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27847.yaml
https://s4e.io/tools/prestashop-xipblog-sql-injection-cve-2023-27847
https://pentest-tools.com/vulnerabilities-exploits/prestashop-xipblog-sql-injection_23138
https://www.vicarius.io/vsociety/vulnerabilities/cve-2023-27847