Cyber Resilience

CVE-2023-27847

CriticalPublic PoC

Published: 27 March 2023

Published
27 March 2023
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.7313 98.8th percentile
Risk Priority 63 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-27847 is a critical-severity SQL Injection (CWE-89) vulnerability in Xipblog Project Xipblog. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 1.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

SQL injection vulnerability affects the xipblog module for PrestaShop at version 2.0.1 and earlier, specifically through the xipcategoryclass and xippostsclass components. The flaw is tracked as CWE-89 and carries a CVSS 3.1 score of 9.8, reflecting network-accessible attack vectors that require no authentication or user interaction.

Unauthenticated remote attackers can supply crafted input to the vulnerable components and obtain elevated privileges, resulting in full compromise of confidentiality, integrity, and availability on the affected PrestaShop installation.

Public advisories published by Friends-of-Presta on 23 March 2023 and the module repository at github.com/xpert-idea/xipblog provide further details for operators. The associated EPSS score currently stands at 0.7313 with a recorded peak of 0.7317.

EU & UK References

Vulnerability details

SQL injection vulnerability found in PrestaShop xipblog v.2.0.1 and before allow a remote attacker to gain privileges via the xipcategoryclass and xippostsclass components.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

xipblog project
xipblog
≤ 2.0.1

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-89

Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.

addresses: CWE-89

Validates query inputs to prevent SQL syntax or command manipulation.

References