CrowdSecLive Exploit Tracker
Limited ExploitationCVE-2023-30150Public Exploit

PrestaShop leocustomajax - SQLi (CVE-2023-30150)

PublishedJun 14, 2023
First SeenNov 23, 2024
Last Seen
Reported
CVSS9.8
Leotheme
Leothemeleocustomajax
ecommerce

Description

PrestaShop leocustomajax 1.0 and 1.0.0 are vulnerable to SQL Injection via modules/leocustomajax/leoajax.php.

psychologyCrowdSec Analysis

CVE-2023-30150 is a vulnerability in PrestaShop’s leocustomajax module that enables SQL injection through crafted requests targeting a specific PHP script.

CrowdSec has been tracking this vulnerability and its exploits since 16th of May 2024.

CrowdSec has not observed any significant exploitation activity targeting CVE-2023-30150 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers are sending requests to URLs referencing /modules/leocustomajax/leoajax.php, attempting to exploit SQL injection vulnerabilities within this endpoint.

lock

Full Intelligence Available

Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.

EventDate
CVE Published2023-06-14
Rule Released2024-05-16
CrowdSec First Seen2024-11-23

Related Weaknesses

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

arrow_forward

Remediation & Protection

lock to download blocklists, subscribe to firewalls, and access IP intelligence.

External References