CVE-2023-30150

published 2023-06-14

CVE-2023-30150: PrestaShop leocustomajax 1.0 and 1.0.0 are vulnerable to SQL Injection via modules/leocustomajax/leoajax.php.

Priority P2 75 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

ITW EXPLOIT VulnCheck KEV

PrestaShop leocustomajax 1.0 and 1.0.0 are vulnerable to SQL Injection via modules/leocustomajax/leoajax.php.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
leotheme	leocustomajax	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /modules/leocustomajax/leoajax.php↗

command POST /modules/leocustomajax/leoajax.php?rand={{random_id}} — body: leoajax=1&pro_add=if(now()=sysdate()%2Csleep(6)%2C0)

command GET /modules/leocustomajax/leoajax.php?cat_list=(SELECT(0)FROM(SELECT(SLEEP(6)))a)

• → Detect exploitation attempts by monitoring POST requests to /modules/leocustomajax/leoajax.php containing time-based SQL injection payloads in the 'pro_add' parameter (e.g., sleep(), sysdate()).
• → Detect exploitation attempts via GET requests to /modules/leocustomajax/leoajax.php with SQL injection payloads in the 'cat_list' parameter (e.g., SLEEP-based blind SQLi).
• → Fingerprint the presence of the vulnerable module by checking for the existence of /modules/leocustomajax/leocustomajax.js and response body containing 'processajax', 'leoajax', 'leocustomajax.css', or 'leosearch'.
• → Use Shodan query 'http.component:"Prestashop"' to identify potentially exposed PrestaShop instances for proactive scanning.
• → Time-based detection: a response duration >= 6 seconds on the POST or GET SQLi request, combined with expected response body/status, confirms successful exploitation.

• · The vulnerability affects only leocustomajax versions 1.0 and 1.0.0; other versions are not confirmed vulnerable. ↗
• · The Nuclei template uses a two-step flow: step 1 confirms module presence before step 2 fires the SQLi payload, reducing false positives.
• · The exploit requires no authentication (PR:N, UI:N) and is remotely exploitable over the network, making it trivially weaponizable.

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vulncheck 9.8 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89