Vulnerability record · CVE-2021-37538 · published 24 August 2021
CVE-2021-37538: SmartBlog for PrestaShop unauthenticated SQL injection
Smartdatasoft · Smartblog
SmartBlog for PrestaShop before 4.06 contains multiple SQL injection flaws in its archive and category front controllers. The day, month, and year parameters in controllers/front/archive.php and the id_category parameter in controllers/front/category.php are not properly sanitized, letting a remote attacker inject arbitrary SQL. Because the module is a public-facing storefront component, any reachable shop running an affected version is exposed.
Description
Multiple SQL injection vulnerabilities in SmartDataSoft SmartBlog for PrestaShop before 4.06 allow a remote unauthenticated attacker to execute arbitrary SQL commands via the day, month, or year parameter to the controllers/front/archive.php archive controller, or the id_category parameter to the controllers/front/category.php category controller.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with no authentication or interaction required, public exploit detail, and a very high EPSS score make this an urgent patch target.
What it is
SmartBlog for PrestaShop before 4.06 contains multiple SQL injection flaws in its archive and category front controllers. The day, month, and year parameters in controllers/front/archive.php and the id_category parameter in controllers/front/category.php are not properly sanitized, letting a remote attacker inject arbitrary SQL. Because the module is a public-facing storefront component, any reachable shop running an affected version is exposed.
Impact
An attacker can execute arbitrary SQL commands against the PrestaShop database, enabling theft of customer and order data, credential extraction, and modification or destruction of stored records. Full compromise of the database layer is possible without any account.
Attack surface
Reached over the network through the public archive and category front controllers of the SmartBlog module; no authentication and no user interaction are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Any internet-exposed PrestaShop store with the affected module is a candidate target.
Exploitation
Not listed in CISA KEV, but EPSS is very high (0.74489 probability, 99.469th percentile) and the references include an Exploit-tagged third-party advisory, indicating public exploit detail is available. No ransomware usage is documented.
What to do
- Upgrade SmartBlog for PrestaShop to version 4.06 or later immediately.
- If patching is not possible, disable or remove the SmartBlog module until it can be updated.
- Apply a WAF rule blocking SQL metacharacters in the day, month, year, and id_category parameters on archive and category routes.
- Restrict direct access to controllers/front/archive.php and controllers/front/category.php where feasible.
- Review database and web logs for prior exploitation attempts and rotate database credentials if compromise is suspected.
Detection
- Search web logs for requests to controllers/front/archive.php and controllers/front/category.php containing SQL keywords, quotes, or comment sequences in day, month, year, or id_category.
- Alert on SQL error strings or unexpected 500 responses from SmartBlog front controllers.
- Monitor database query logs for UNION, stacked queries, or information_schema access originating from the web application user.
- Baseline normal parameter values for these controllers and flag deviations in length or character set.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://blog.sorcery.ie/posts/smartblog_sqli/ | ExploitThird Party Advisory |
| https://classydevs.com/free-modules/smartblog/ | ProductVendor Advisory |
| https://blog.sorcery.ie/posts/smartblog_sqli/ | ExploitThird Party Advisory |
| https://classydevs.com/free-modules/smartblog/ | ProductVendor Advisory |
Track CVE-2021-37538 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-37538), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
