CVE-2023-6921 is a critical (CVSS 9.8) blind SQL injection in the PrestaShow Google Integrator module for PrestaShop, exploitable through a cookie. CERT Polska says it is fixed in version 2.1.4 and that all earlier versions are vulnerable. Update to 2.1.4 or later.
What's affected
CERT Polska's advisory says the vendor confirmed the weakness, that version 2.1.4 fixes it and that every version below 2.1.4 is vulnerable. It adds that users of older versions can download a free update from their PrestaShow account.
The record lists the product as a PrestaShop addon. The attack described reaches the database through command insertion in one of the cookies, which means it needs no login to the shop.
How to check if you're exposed
Open the PrestaShop back office, go to Module Manager and read the version of PrestaShow Google Integrator. You can also check the module's configuration file on disk.
grep -i "version" modules/*/config.xml 2>/dev/null | grep -i google
Any version below 2.1.4 is vulnerable. Also review web server logs for unusual cookie values on storefront requests.
What to do now
- Download and install version 2.1.4 or later from your PrestaShow account.
- Review the database for modified or unexpected records, and check admin accounts.
- Rotate database credentials and any API keys the shop holds if you suspect misuse.
- Put a web application firewall rule in front of the shop as a short-term layer, not a replacement for the update.
Why it matters
Blind SQL injection means the page does not print query results, so an attacker infers data from timing or small differences in responses. It is slower than other forms but still allows data extraction and modification, as the record says. Cookies are easy to forget as an input source, because developers think of forms and URL parameters first.
SQL injection happens when input is mixed into a query as text instead of being passed as a bound parameter. The database cannot tell the developer's query from the attacker's additions. Parameterized queries remove the whole class, and they are cheap to adopt. Treat every value from the client, including cookies and headers, as hostile input.
Desktop and agent software is easy to miss because it sits outside the usual server patch cycle. Build a list of where it runs, push the update through your software deployment tool, and confirm the installed version afterward rather than trusting the job status.
Weakness class in the record: CWE-89 (SQL Injection).
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why does a cookie matter for SQL injection?
Anything the browser sends is attacker-controlled. If the module puts a cookie value into a query as text, that cookie becomes a way to talk to the database.
How do I confirm the fix landed?
Check the version on a sample of hosts after rollout and keep the output as evidence. Deployment tools can report success while some hosts miss the update.
Sources
Last reviewed: 19 October 2026.
