CVE-2023-29629
📋 TL;DR
CVE-2023-29629 is a critical SQL injection vulnerability in the jmsthemelayout module for PrestaShop. Attackers can execute arbitrary SQL commands through the ajax_jmsvermegamenu.php endpoint, potentially compromising the entire database. All PrestaShop installations using jmsthemelayout version 2.5.5 are affected.
💻 Affected Systems
- PrestaShop jmsthemelayout module
📦 What is this software?
Jmsthemelayout by Jmsthemelayout Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation, and potential remote code execution via database functions.
Likely Case
Data exfiltration including customer information, admin credentials, and sensitive business data.
If Mitigated
Limited impact with proper input validation and database user privilege restrictions.
🎯 Exploit Status
The vulnerability is in a publicly accessible PHP file with insufficient input sanitization, making exploitation straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 2.5.6 or later
Vendor Advisory: https://friends-of-presta.github.io/security-advisories/modules/2023/03/13/jmsthemelayout.html
Restart Required: No
Instructions:
1. Update the jmsthemelayout module to version 2.5.6 or later via PrestaShop admin panel or manual installation. 2. Clear PrestaShop cache. 3. Verify the module functions correctly after update.
🔧 Temporary Workarounds
Disable vulnerable endpoint
linuxTemporarily block access to the vulnerable PHP file
mv modules/jmsthemelayout/ajax_jmsvermegamenu.php modules/jmsthemelayout/ajax_jmsvermegamenu.php.disabled
Web server block
allAdd web server rule to block access to the vulnerable file
# For Apache: add to .htaccess
<Files "ajax_jmsvermegamenu.php">
Order allow,deny
Deny from all
</Files>
# For Nginx: add to server block
location ~* /ajax_jmsvermegamenu\.php$ {
deny all;
return 403;
}
🧯 If You Can't Patch
- Implement strict WAF rules to block SQL injection patterns targeting the ajax_jmsvermegamenu.php endpoint
- Restrict database user permissions to SELECT only for the jmsthemelayout module database user
🔍 How to Verify
Check if Vulnerable:
Check if modules/jmsthemelayout/ajax_jmsvermegamenu.php exists and examine its version in the module's configuration file.Check Version:
grep -r 'version' modules/jmsthemelayout/config.xml 2>/dev/null || echo 'Module not found'Verify Fix Applied:
Verify the module version is 2.5.6 or higher in PrestaShop admin panel under Modules > Module Manager.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /modules/jmsthemelayout/ajax_jmsvermegamenu.php
- SQL error messages in web server logs
- Multiple failed login attempts following exploitation
Network Indicators:
- Unusual database queries from web server IP
- Large data exfiltration from database server
SIEM Query:
source="web_server_logs" AND uri="/modules/jmsthemelayout/ajax_jmsvermegamenu.php" AND (status=500 OR method=POST)