Cyber Security News

PrestaShop Website Under Injection Attack Via Facebook Module

A critical vulnerability has been discovered in the “Facebook” module (pkfacebook) from Promokit.eu for PrestaShop.

The vulnerability, CVE-2024-36680, allows a guest to perform SQL injection attacks on affected module versions.

CVE-2024-36680 – Vulnerability Details

The vulnerability stems from the Ajax script, which contains a sensitive SQL call that can be executed with a trivial HTTP call.

Attackers can exploit this vulnerability to forge SQL injection attacks and gain unauthorized access to the associated PrestaShop database.

According to the module’s author, Promokit.eu, the exact versions impacted by this vulnerability are unknown, as it was introduced long ago.

The author has refused to provide the latest version so that security researchers can verify whether the issue has been fully resolved.

Scan Your Business Email Inbox to Find Advanced Email Threats - Try AI-Powered Free Threat Scan

As a precautionary measure, all module versions should be considered potentially vulnerable.

Active Exploitation and Warnings

Alarmingly, malicious actors are actively using this exploit to deploy webskimmers, which are designed to steal credit card information from unsuspecting customers.

PrestaShop website owners are urged to take immediate action to mitigate the risk of data theft and unauthorized access.

Mitigation and Recommendations

To protect PrestaShop installations from this vulnerability, upgrading to the latest version of the pkfacebook module is highly recommended.

Additionally, PrestaShop users should consider the following security measures:

  1. Upgrade PrestaShop to the latest version to disable multi-query executions and enhance overall security.
  2. Ensure that the pSQL function, which includes, is properly implemented to protect against Stored XSS vulnerabilities.
  3. Change the default database prefix ps_ to a longer, arbitrary prefix to make it more difficult for attackers to guess.
  4. OWASP 942’s rules on a Web Application Firewall (WAF) will be activated to strengthen security further while being aware of potential conflicts with the back office functionality.

PrestaShop website owners are advised to address this critical vulnerability swiftly and implement the recommended security measures to safeguard their online stores and protect customer data from potential breaches.

Free Webinar! 3 Security Trends to Maximize MSP Growth -> Register For Free

Divya

Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Recent Posts

Hackers Claiming Dettol Data Breach: 453,646 users Impacted

A significant data breach has been reported by a threat actor known as 'Hana,' who claims to have compromised the…

2 days ago

CrowdStrike Update Triggers Widespread Windows BSOD Crashes

A recent update from cybersecurity firm CrowdStrike has caused significant disruptions for Windows users, leading to widespread reports of Blue…

2 days ago

Operation Spincaster Disrupts Approval Phishing Technique that Drains Victim’s Wallets

Chainalysis has launched Operation Spincaster, an initiative to disrupt approval phishing scams that have drained billions from victims' wallets. This…

2 days ago

Octo Tempest Know for Attacking VMWare ESXi Servers Added RansomHub & Qilin to Its Arsenal

Threat actors often attack VMware ESXi servers since they accommodate many virtual machines, which link to a variety of systems…

3 days ago

TAG-100 Actors Using Open-Source Tools To Attack Gov & Private Orgs

Hackers exploit open-source tools to execute attacks because they are readily available, well-documented, and often have extensive community support, making…

3 days ago

macOS Users Beware Of Weaponized Meeting App From North Korean Hackers

Meeting apps are often targeted and turned into weapons by hackers as they are largely employed for communication and collaboration,…

3 days ago