CVE-2023-30150
📋 TL;DR
This vulnerability allows attackers to execute arbitrary SQL commands through the leocustomajax module in PrestaShop. It affects all websites running PrestaShop with leocustomajax versions 1.0 or 1.0.0 installed. Successful exploitation could lead to complete database compromise.
💻 Affected Systems
- PrestaShop leocustomajax module
📦 What is this software?
Leocustomajax by Leotheme
⚠️ Risk & Real-World Impact
Worst Case
Complete database takeover, data exfiltration, privilege escalation, and potential remote code execution through database functions.
Likely Case
Database information disclosure, including customer data, orders, and administrative credentials.
If Mitigated
Limited impact with proper input validation and database user privilege restrictions.
🎯 Exploit Status
SQL injection is well-understood and weaponized tools exist. The vulnerability requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.1
Vendor Advisory: https://friends-of-presta.github.io/security-advisories/module/2023/06/06/leocustomajax.html
Restart Required: No
Instructions:
1. Download leocustomajax version 1.0.1 from official PrestaShop marketplace. 2. Replace the existing leocustomajax module files. 3. Clear PrestaShop cache from the admin panel.
🔧 Temporary Workarounds
Disable leocustomajax module
allTemporarily disable the vulnerable module until patching is possible.
Navigate to PrestaShop admin > Modules > Module Manager > leocustomajax > Disable
Block vulnerable endpoint
linuxUse web application firewall or .htaccess to block access to the vulnerable file.
Add to .htaccess: Deny from all for /modules/leocustomajax/leoajax.php
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries at application level
- Restrict database user permissions to minimum required operations
🔍 How to Verify
Check if Vulnerable:
Check if /modules/leocustomajax/leoajax.php exists and examine the file for lack of parameterized queries.Check Version:
Check module version in PrestaShop admin: Modules > Module Manager > leocustomajaxVerify Fix Applied:
Verify leocustomajax module version is 1.0.1 in PrestaShop admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple requests to /modules/leocustomajax/leoajax.php with SQL-like parameters
Network Indicators:
- HTTP requests containing SQL keywords (SELECT, UNION, etc.) to the vulnerable endpoint
SIEM Query:
source="web_logs" AND uri="/modules/leocustomajax/leoajax.php" AND (query="SELECT" OR query="UNION" OR query="INSERT")