CVE-2023-27847
Published: 27 March 2023
Summary
CVE-2023-27847 is a critical-severity SQL Injection (CWE-89) vulnerability in Xipblog Project Xipblog. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 1.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
SQL injection vulnerability affects the xipblog module for PrestaShop at version 2.0.1 and earlier, specifically through the xipcategoryclass and xippostsclass components. The flaw is tracked as CWE-89 and carries a CVSS 3.1 score of 9.8, reflecting network-accessible attack vectors that require no authentication or user interaction.
Unauthenticated remote attackers can supply crafted input to the vulnerable components and obtain elevated privileges, resulting in full compromise of confidentiality, integrity, and availability on the affected PrestaShop installation.
Public advisories published by Friends-of-Presta on 23 March 2023 and the module repository at github.com/xpert-idea/xipblog provide further details for operators. The associated EPSS score currently stands at 0.7313 with a recorded peak of 0.7317.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-31583
Vulnerability details
SQL injection vulnerability found in PrestaShop xipblog v.2.0.1 and before allow a remote attacker to gain privileges via the xipcategoryclass and xippostsclass components.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.