MathiasReker / blmvuln

Major Security Vulnerability on PrestaShop Websites - CVE-2022-31101
MIT License
41 stars 6 forks source link

Can't Uninstall the Module #11

Closed rafael-ribas closed 1 year ago

rafael-ribas commented 1 year ago

Issue: I couldn`t run nor configure the module and now I can't uninstall nor delete the module files. The hiperlink to the BLM vulnerability module at the administration left panel is still there.

Steps:

  1. I've downloaded the module at https://github.com/MathiasReker/blmvuln/releases/tag/2.2.1, and installed in my prestashop 8.0.2 version.
  2. Got an "incompatibility error" message and a "500 internal error" response from the server when I tried to configure the module using the left panel hiperlink.
  3. Went to the "module manager" and tried to uninstall and delete the files, but got the following response: "The uninstall action is not available for the blmvuln module. Ignored."

I've checked the comment and the Issue #4, but it seems that the version 2.2.1 isn't deleting the menu entry. I tought it would be interesting to record the issue appearance on the newer version.

Anyway, I couldnt' remove the menu entry using the method above. :-(

MathiasReker commented 1 year ago

Hello

What version of Prestashop do you use?

Can you see the actual error 500 description in your logs?

rafael-ribas commented 1 year ago

Hello, @MathiasReker! Thanks for the reply

What version of Prestashop do you use? PrestaShop: 8.0.2

Can you see the actual error 500 description in your logs? After activating the debug mode in the administration menu, I got the following message:

[PrestaShopException]
Module blmvuln not found
at line 51 in file classes/controller/ModuleAdminController.php

46.             throw new PrestaShopException('Admin tab ' . get_class($this) . ' is not a module tab');
47.         }
48. 
49.         $this->module = Module::getInstanceByName($tab->module);
50.         if (!$this->module->id) {
51.             throw new PrestaShopException("Module {$tab->module} not found");
52.         }
53.     }
54. 
55.     /**
56.      * Creates a template object.
ModuleAdminControllerCore->__construct - [line 246 - classes/controller/Controller.php] - [2 Arguments]
241.      *
242.      * @return Controller
243.      */
244.     public static function getController($class_name, $auth = false, $ssl = false)
245.     {
246.         return new $class_name($auth, $ssl);
247.     }
248. 
249.     public function __construct()
250.     {
251.         if (null === $this->display_header) {
ControllerCore::getController - [line 504 - classes/Dispatcher.php] - [1 Arguments]
499.         }
500. 
501.         // Instantiate controller
502.         try {
503.             // Loading controller
504.             $controller = Controller::getController($controller_class);
505. 
506.             // Execute hook dispatcher
507.             Hook::exec('actionDispatcher', $params_hook_action_dispatcher);
508. 
509.             // Running controller
DispatcherCore->dispatch - [line 92 - admin/index.php]
87.     if (!headers_sent()) {
88.         header('Content-Type: text/html; charset=utf-8');
89.     }
90. 
91.     // Prepare and trigger LEGACY admin dispatcher
92.     Dispatcher::getInstance()->dispatch();
93. }

Website Message:

500 Server Error
Oops, something went wrong.
Try to refresh this page or feel free to contact us if the problem persists.
MathiasReker commented 1 year ago

Thanks. I have not tested the module on Prestashop 8 yet. I will look into this.

However, this module fixed a security issue that was already fixed in Prestashop 8, therefor this module should not be necessary.

rafael-ribas commented 1 year ago

Thanks. I have not tested the module on Prestashop 8 yet. I will look into this.

However, this module fixed a security issue that was already fixed in Prestashop 8, therefor this module should not be necessary.

Ok then, thanks for your reply.

Here's the solution I found to remove the menu entries from the left menu of Prestashop 8.0.2:

Using phpMyAdmin, I selected the pshop_tab, then selected the rows with the module value set to blmvuln and changed the value of the active column from 1 to 0.