In an era where digital privacy is more important than ever, it is crucial to ensure that our personal information is safeguarded from unauthorized access. With the recent discovery of a security vulnerability in the Ecomiz Survey TMA Module for PrestaShop, users of the e-commerce platform need to be aware of the potential for data breaches. CVE-2024-24309 impacts the Ecomiz "Survey TMA" (ecomiz_survey_tma) module, versions up to 2.., and allows a guest visitor to gain access and download confidential information without restrictions. In this article, we will delve into the details of the vulnerable module, the vulnerability itself, and possible exploit scenarios. Furthermore, we will provide recommendations for mitigating the risks associated with this issue.

Vulnerability (CVE-2024-24309)

The security vulnerability exists in the Ecomiz "Survey TMA" (ecomiz_survey_tma) module, which provides a survey functionality for e-commerce websites built on the PrestaShop platform. The vulnerability specifically affects versions of the module up to 2... An attacker, or hostile visitor, can exploit this vulnerability by simply visiting a website that is utilizing a vulnerable version of the Ecomiz Survey TMA module and make illegitimate requests to download private user information, such as names, addresses, and email addresses.

Original References

The vulnerability was initially disclosed by a group of security researchers. Their findings and technical details about the issue can be found in the following links:

1. CVE-2024-24309 - National Vulnerability Database (NVD) Entry
2. Security Advisory - EXPLOIT-DB Entry

Code Snippet Demonstrating Vulnerability

The vulnerability lies in the ecomiz_survey_tma module, where the code allows guest users to proceed with the download functionality without properly verifying their permissions. The following snippet, extracted from the vulnerable module, showcases this issue:

public function downloadUserInfo() {
    // User ID is being fetched from the request.
    $user_id = Tools::getValue('user_id');
    // Fetching userinfo from database.
    $user_info = $this->getUserInfo($user_id);
    // Sending the user's personal information for download.
    $this->sendDownload($user_info);
}

Exploit Scenario

For the sake of demonstration, let's assume an attacker is aware of the vulnerable PrestaShop website, www.xyz.com, which uses the Ecomiz Survey TMA module. Based on their knowledge of the vulnerability, the attacker sends a request to this website to download user data. The request might look like:

GET http://www.xyz.com/index.php?controller=download&module=ecomiz_survey_tma&user_id=1

As a result of this malicious request, the attacker will be able to download the personal information of user ID 1 without any restriction.

Mitigation Steps

Considering the severity of this vulnerability, it is imperative to take immediate steps to safeguard against illicit data access. For users of the Ecomiz Survey TMA module, the following recommendations are provided:

1. Update the Ecomiz Survey TMA module to the latest version (≥2.1.) which contains the necessary security fixes. This can be achieved by visiting the module's product page on the PrestaShop Addons Store and following the update instructions provided by the developers.

Contact the Ecomiz support team for additional guidance, if needed.

3. Review the website's access logs for any suspicious activity to ensure that the vulnerability has not been exploited.

Conclusion

In this article, we have highlighted and explored the CVE-2024-24309 vulnerability within the Ecomiz Survey TMA module for PrestaShop e-commerce websites. It is now the responsibility of website administrators to ensure that appropriate measures are taken to protect their user's information from being accessed and misused by unauthorized individuals. By updating the Ecomiz Survey TMA module to the latest available version and vigilantly monitoring website activity, administrators can minimize the risk associated with this particular security vulnerability.

Timeline

Published on: 02/23/2024 22:15:54 UTC
Last modified on: 08/01/2024 13:47:25 UTC