Critical · published October 25, 2023
🚨 A mere HTTP call can unleash chaos! The NDK Design module for PrestaShop has a SQL injection vulnerability that lets guests bypass security with shocking ease. 🔥 Think of it like a restaurant that allows anyone to reorder any dish just by saying the name, without checking if they even ordered it—total recipe anarchy! This vulnerability allows an attacker to run any SQL command as if they were the chef in the kitchen. An attacker could gain unauthorized access to sensitive data, modify existing records, or even delete crucial information. This could lead to a complete loss of trust and integrity for your online store, making it absolutely devastating for your business.
Think of it like a restaurant that allows anyone to reorder any dish just by saying the name, without checking if they even ordered it—total recipe anarchy! This vulnerability allows an attacker to run any SQL command as if they were the chef in the kitchen. The flaw resides in the `NdkSpack::getPacks()` method, which contains sensitive SQL calls that can be executed by a guest user through a trivial HTTP request, allowing for SQL injection attacks.
An attacker could gain unauthorized access to sensitive data, modify existing records, or even delete crucial information. This could lead to a complete loss of trust and integrity for your online store, making it absolutely devastating for your business. Immediately upgrade to version 1.5.7 or later of the Step by Step products Pack. Additionally, audit your SQL queries to ensure proper parameterization to defend against injection risks. You've got this! With these steps, you'll tighten your security and keep your store safe. 🛡️