CVE-2023-45379 in Rotator Img Module
Summary
by MITRE • 10/25/2023
In the module "Rotator Img" (posrotatorimg) in versions at least up to 1.1 from PosThemes for PrestaShop, a guest can perform SQL injection.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/10/2026
The vulnerability CVE-2023-45379 affects the Rotator Img module version 1.1 and earlier distributed by PosThemes for the PrestaShop e-commerce platform. This issue represents a critical security flaw that allows unauthenticated attackers to execute arbitrary SQL commands against the underlying database. The vulnerability specifically resides within the module's handling of user input parameters that are not properly sanitized or validated before being incorporated into SQL queries.
The technical exploitation of this SQL injection vulnerability occurs when a guest user submits malicious input through parameters that are processed by the rotatorimg module. The module fails to implement proper input validation and sanitization measures, allowing attackers to inject malicious SQL code that gets executed within the database context. This flaw enables attackers to perform unauthorized data access, modification, or deletion operations, potentially leading to complete database compromise. The vulnerability is classified as CWE-89 SQL Injection, which is a well-documented and dangerous category of vulnerabilities that consistently ranks among the top security risks in web applications. According to the ATT&CK framework, this vulnerability maps to T1190 Exploit Public-Facing Application, where attackers leverage publicly accessible web applications to gain unauthorized access to backend systems.
The operational impact of this vulnerability is severe for PrestaShop stores using the affected module version. Attackers can extract sensitive customer data, including personal information, order details, and payment records that are typically stored in the database. The vulnerability also enables attackers to modify or delete critical business data, potentially disrupting operations and causing financial losses. Additionally, the compromise of database integrity can lead to further attacks such as privilege escalation, where attackers gain administrative access to the PrestaShop backend. The vulnerability affects not only the module's functionality but also the overall security posture of the e-commerce platform, as database breaches can provide attackers with access to other interconnected systems and services within the organization's infrastructure.
Organizations using the affected module should immediately implement mitigation strategies to protect their systems from exploitation. The primary recommendation is to update to the latest version of the Rotator Img module from PosThemes, which should contain the necessary security patches to address the SQL injection vulnerability. System administrators should also implement proper input validation and parameterized queries to prevent similar issues in other custom modules or applications. Network-level protections such as web application firewalls can provide additional defense-in-depth measures to detect and block malicious SQL injection attempts. Regular security audits and vulnerability assessments should be conducted to identify and remediate similar issues across the entire PrestaShop installation and its associated modules. The vulnerability also highlights the importance of maintaining up-to-date software components and implementing proper security testing procedures before deploying new modules or updates to production environments.