This blog post details an SQLi I found in Blog for Prestashop (ph_simpleblog) by Prestahome, it is also my first CVE 😊 To begin with I had to identify that the module was installed, it is a blog plugin so this can generally be spotted by looking at the page source of the blog but you can also test if Prestashop modules are installed more directly by checking https://example.com/modules/ph_simpleblog/config.xml. This Prestashop module uses the controller functionality so that’s where I started to look as it’s usually where the user input will go first.