cbcvebase.
CVE-2021-36748
published 2021-08-20

CVE-2021-36748: A SQL Injection issue in the list controller of the Prestahome Blog (aka ph_simpleblog) module before 1.7.8 for Prestashop allows a remote attacker to extract…

PriorityP265high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EXPLOIT
EPSS
15.42%
96.4th percentile
A SQL Injection issue in the list controller of the Prestahome Blog (aka ph_simpleblog) module before 1.7.8 for Prestashop allows a remote attacker to extract data from the database via the sb_category parameter.

Affected

1 ranges
VendorProductVersion rangeFixed in
prestahomeblog< 1.7.81.7.8

Detection & IOCsextracted from sources · hover to see the quote

url/module/ph_simpleblog/list?sb_category=')%20OR%20true--%20-↗
url/module/ph_simpleblog/list?sb_category=')%20AND%20false--%20-↗
path/module/ph_simpleblog/list↗
  • →Blind SQL injection probe: a TRUE condition (') OR true-- -) returns HTTP 200 with 'prestashop' in body, while a FALSE condition (') AND false-- -) returns HTTP 404 with 'index.php?controller=404' in the Location/header and an empty body. Differential response confirms exploitability. ↗
  • →The vulnerable parameter is `sb_category` in GET requests to the ph_simpleblog list controller endpoint. Monitor web logs for SQL meta-characters (quotes, comment sequences `--`, boolean keywords OR/AND true/false) in this parameter. ↗
  • →Affected module identifier is `ph_simpleblog`; presence of this module path in web server logs combined with anomalous `sb_category` values is a strong indicator of exploitation attempts. ↗
  • ·The detection relies on differential HTTP response codes (200 vs 404) and specific body/header content. WAFs, caching layers, or custom error pages may alter these responses and cause false negatives or false positives. ↗
  • ·Only versions of ph_simpleblog strictly before 1.7.8 are vulnerable; the detection template targets `cpe:2.3:a:prestahome:blog:*:*:*:*:*:prestashop:*:*` with no upper-bound version lock, so patched instances may still match the path-based probe. ↗

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.