CVE-2023-46347 — AI Deep Analysis Summary

🚨 **Essence**: SQL Injection in PrestaShop module `ndk_steppingpack`. <br>💥 **Consequences**: Attackers can manipulate database queries, potentially leading to data theft or system compromise.…

🛡️ **Root Cause**: The function `NdkSpack::getPacks()` contains an SQL injection flaw.…

📦 **Affected**: PrestaShop installations using the **NDK Design** module `ndk_steppingpack`. <br>📅 **Version**: Versions **up to 1.5.6** are vulnerable.…

🕵️ **Hackers Can**: Perform **SQL Injection** as a **guest** (unauthenticated user).…

🔓 **Threshold**: **LOW**. <br>👤 **Auth**: No authentication required (**Guest** access). <br>⚙️ **Config**: Only requires the vulnerable module version to be installed. Easy to trigger remotely.

📜 **Public Exp**: **YES**. <br>🔍 **PoC**: Available via **ProjectDiscovery Nuclei Templates** (CVE-2023-46347.yaml). <br>🌐 **Wild Exp**: Likely exploitable given the public PoC and low barrier to entry.

🔍 **Self-Check**: <br>1. Scan for `ndk_steppingpack` module version ≤ 1.5.6. <br>2. Use Nuclei template `CVE-2023-46347.yaml` for automated detection. <br>3.…

🩹 **Fix**: Update the `ndk_steppingpack` module to a version **greater than 1.5.6**. <br>📢 **Source**: Official advisory from **Friends of Presta** (Oct 24, 2023) confirms the vulnerability and likely fix availability.

🚧 **No Patch Workaround**: <br>1. **Disable/Remove** the `ndk_steppingpack` module immediately. <br>2. **WAF Rules**: Block SQL injection patterns targeting the `getPacks` endpoint. <br>3.…

🔥 **Urgency**: **HIGH**. <br>⚡ **Reason**: Unauthenticated SQL Injection is critical. Public PoC exists. Immediate patching or module removal is recommended to prevent data breaches.