search

advisto / peel-shopping

PEEL Shopping 9.0 : CMS ecommerce open source solution. Multilingual, multi-template engine Smarty or Twig, HTML 5, fast and reliable
http://www.peel-shopping.com
Other
4 stars 1 forks source link

SQL Injection in "utilisateurs.php" id_utilisateur POST parameter (Authenticated) #5

Open Frentzen opened 2 years ago

Frentzen commented 2 years ago

Product Version: 9.4.0

Author: Frentzen

CVE Assigned: CVE-2021-41672

Vulnerability Description: Authenticated user (with some administrator pivileges) can inject malicious query in order to achive SQL injection via "id_utilisateur" POST parameter on the /peel-shopping_9_4_0/administrer/utilisateurs.php endpoint. After this attack, attacker can read sensitive information from the database and until modify its data.

Vulnerable URL: http://localhost/peel-shopping_9_4_0/administrer/utilisateurs.php

Proof of Concept:

cverequest2

cveresponse

fgeek commented 2 years ago

Looks like prepared statements are not used at all (checked multiple php file) so there will be lot of more SQL-injections. All of the queries need an update.