Critical · published June 19, 2024
🚨 A trivial HTTP request is all it takes for a guest to perform SQL injection in PrestaShop's Custom Links module! 🔥 Think of it as a diner who walks into a restaurant and starts rewriting the menu — they could order just about anything without even being a customer! This SQL injection flaw lets attackers manipulate the database as if they had insider access. What could happen? An attacker could execute arbitrary SQL commands, leading to full database exposure. This means they could read sensitive customer data, modify transactions, or even delete essential records—absolutely devastating for any business.
Think of it as a diner who walks into a restaurant and starts rewriting the menu — they could order just about anything without even being a customer! This SQL injection flaw lets attackers manipulate the database as if they had insider access. The vulnerability stems from a sensitive SQL call in ajax.php within the Custom Links module (pk_customlinks) for PrestaShop versions up to 2.3. It allows unauthenticated users to forge an SQL injection simply by sending a crafted HTTP request.
What could happen? An attacker could execute arbitrary SQL commands, leading to full database exposure. This means they could read sensitive customer data, modify transactions, or even delete essential records—absolutely devastating for any business. Immediately update to the latest version of the Custom Links module to remediate this issue. Additionally, review your database access permissions and implement web application firewalls to help mitigate SQL injection risks. Don't skip those security audits! You’ve got this! With these steps, you can secure your site and protect your customers. 🛡️