• Skip to primary navigation
  • Skip to content
  • Skip to primary sidebar
  • Skip to footer

Sucuri Blog

Website Security News

  • Products
    • Website Security Platform
    • Website Firewall (WAF)
    • Enterprise Website Security
    • Multisite Solutions
  • Features
    • Detection
    • Protection
    • Performance
    • Response
    • Backups
  • Partners
    • Agency Solutions
    • Partners
    • Referral Program
    • Ecommerce
  • Resources
    • Guides
    • Webinars
    • Infographics
    • SiteCheck
    • Reports
    • Email Courses
  • Immediate Help
  • Login
Labs Note

PrestaShop SuperAdmin Injector and Login Stealer

November 18, 2020Luke Leal

203
SHARES
FacebookTwitterSubscribe

According to W3Tech’s data, PrestaShop is among the most popular CMS choices for existing ecommerce websites, so it should come as no surprise that malware has been created to specifically target these environments.

We recently came across an infected PrestaShop website with malware which was automatically injecting a super admin PrestaShop user whenever the website owner logged into the backend.

The malware was found injected into the following existing PrestaShop core files:

./controllers/admin/AdminLoginController.php
./classes/Employee.php

The injected PHP code works by checking the $email variable contents — which, by default, stores the email address used when trying to log into PrestaShop.

If the contents of $email contains the string bajatax, a SQL query is run to get all the data from the _employee database table.

PrestaShop Database Table

After the query is finished running, the PHP code uses existing PrestaShop functions to construct an instance of the object “employee” for the email address containing the string bajatax and assign it super admin privileges.

This means that once the malicious code has been injected, the attacker can simply attempt to log into the backend and, even though the email address they use does not exist as a super admin user, it gets created by the PHP code.

Implications for this malware extend beyond simply grabbing data from the employee database table, as bad actors often upgrade and modify their code with new features to harvest additional information, perform new behavior, or evade detection.

To protect your website and detect malicious behavior, consider employing integrity control checks and security monitoring services on your site.

203
SHARES
FacebookTwitterSubscribe

Categories: Ecommerce Security, Sucuri Labs, Website Malware Infections, Website SecurityTags: Black Hat Tactics, Hacked Websites, Labs Note, Malware

About Luke Leal

Luke Leal is a member of the Malware Research team and joined the company in 2015. Luke's main responsibilities include threat research and malware analysis, which is used to improve our tools. His professional experience covers over eight years of deobfuscating malware code and using unique data from it to help in correlating patterns. When he’s not researching infosec issues or working on websites, you might find Luke traveling and learning about new things. Connect with him on Twitter.

Reader Interactions

Primary Sidebar

Socialize With Sucuri

We're actively engaged across multiple platforms. Follow us and let's connect!

  • Facebook
  • Twitter
  • LinkedIn
  • YouTube
  • Instagram
  • RSS Feed

The Anatomy of Website Malware Webinar

PCI Compliance Guide

Join Over 20,000 Subscribers!

Footer

Products

  • Website Firewall
  • Website AntiVirus
  • Website Backups
  • WordPress Security
  • Enterprise Services

Solutions

  • DDos Protection
  • Malware Detection
  • Malware Removal
  • Malware Prevention
  • Blacklist Removal

Support

  • Blog
  • Knowledge Base
  • SiteCheck
  • Research Labs
  • FAQ

Company

  • About
  • Media
  • Events
  • Employment
  • Contact
  • Testimonials
  • Facebook
  • Twitter
  • LinkedIn
  • Instagram

Customer Login

Sucuri Home

  • Terms of Use
  • Privacy Policy
  • Frequently Asked Questions

© 2022 Sucuri Inc. All rights reserved

Sucuri Cookie Policy
See our policy>>

Our website uses cookies, which help us to improve our site and enables us to deliver the best possible service and customer experience.