CVE-2023-27847

CRITICAL NUCLEI

xipblog < 2.0.1 - SQL Injection via xipcategoryclass and xippostsclass Components

Title source: llm

Exploitation Summary

CVE-2023-27847 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

SQL injection vulnerability found in PrestaShop xipblog v.2.0.1 and before allow a remote attacker to gain privileges via the xipcategoryclass and xippostsclass components.

Nuclei Templates (1)

PrestaShop xipblog - SQL Injection

CRITICALVERIFIEDby mastercho

Shodan: html:"/xipblog"

FOFA: app="Prestashop"

References (2)

Core 2

Core References

Exploit, Third Party Advisory

https://friends-of-presta.github.io/security-advisories/modules/2023/03/23/xipblog.html

Product

https://github.com/xpert-idea/xipblog/

View Writeup ZIP pw:eip

Scores

CVSS v3 9.8

EPSS 0.0471

EPSS Percentile 90.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

CWE

CWE-89

Status published

Products (1)

xipblog_project/xipblog < 2.0.1

Published Mar 27, 2023

Tracked Since Feb 18, 2026