CVE-2024-33276: 
Prestashop vulnerability analysis and mitigation

SQL Injection vulnerability identified in FME Modules preorderandnotication version 3.1.0 and earlier, discovered on January 17, 2024, and disclosed on April 25, 2024. The vulnerability affects the PreorderModel::getIdProductAttributesByIdAttributes() method in the PrestaShop module, allowing remote attackers to execute arbitrary SQL commands (Friends Of Presta).

The vulnerability exists in the PreorderModel::getIdProductAttributesByIdAttributes() method, which contains a sensitive SQL call that can be executed through a trivial HTTP request. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network attack vector, low complexity, no privileges required, and no user interaction needed (Friends Of Presta).

The vulnerability can be exploited to obtain admin access, remove data from the associated PrestaShop installation, expose sensitive data including tokens, unlock admin's ajax scripts, and potentially hijack emails by rewriting SMTP settings. Attackers can conceal the module controller's path during exploitation, making it difficult to detect in conventional frontend logs (Friends Of Presta).

The vulnerability can be exploited by guest users without authentication. The exploit uses a PrestaShop front controller, and attackers can hide their activities in conventional frontend logs, showing only "POST /" requests. Detection requires activation of the AuditEngine of mod_security or similar security tools (Friends Of Presta).

The vulnerability has been fixed in version 3.1.1 of the module. Users are strongly recommended to upgrade to the latest version. Additional security recommendations include changing the default database prefix ps_ to a longer, arbitrary prefix, activating OWASP 942's rules on the WAF (with necessary bypasses for the backoffice), and ensuring proper implementation of PrestaShop's pSQL function to protect against Stored XSS vulnerabilities (Friends Of Presta).