NetbyteSEC Security Advisory - Unauthenticated Blind SQL Injection vulnerability In PEEL Shopping
Title: Unauthenticated Blind SQL Injection vulnerability In PEEL Shopping
Advisory ID: NBS-2021-0001
Product: PEEL Shopping
Vulnerable Version: 9.4.0
Fixed Version: 9.4.0.1
CVE ID: CVE-2021-37593
Homepage: https://www.peel-shopping.com/
Date of Discovery: 10 July 2021
Author: Mohammad Faisal Sammio | NetbyteSEC
Vendor/product description:
"PEEL SHOPPING is a free ecommerce CMS in PHP / MySQL, that is to say a a modern and safety management tool that lets you manage your product catalog, the text on your website and everything else from a single, simple and efficient administrative interface. Since 2004, PEEL brings innovation and reliability to the world of e-commerce by offering tailored solutions to create complete and simple online shops at suitable prices for everyone."
Source: https://www.peel-shopping.com/
Vulnerability overview:
PEEL Shopping version 9.4.0 allows remote SQL injection. A public user/guest (unauthenticated) can inject a malicious SQL query in order to affect the execution of predefined SQL commands. Upon a successful SQL injection attack, an attacker can read sensitive data from the database and possibly modify database data.
Technical details:
There are three (3) files that associated to the vulnerability as mentioned in technical details below. The files are produit_details.php , fonctions.php and configuration.inc.php
 |
| Figure 1: file - achat/produit_details.php |
line 22 - product_infos initialized an array() function to hold product info values
 |
| Figure 2: file - achat/produit_details.php |
line 55 - product_infos request input (user-controlled) via id parameter without being sanitized to be passed into arguments of get_product_infos() function.
**Since id is a type of integer, the proper sanitization method would be intval()