CVE-2023-30150

CRITICALNuclei

leotheme leocustomajax Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2023-30150 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

PrestaShop leocustomajax 1.0 and 1.0.0 are vulnerable to SQL Injection via modules/leocustomajax/leoajax.php.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jun 8, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 6, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

leocustomajax

Browse leotheme / leocustomajax
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALPrestaShop leocustomajax 1.0 & 1.0.0 - SQL InjectionCVSS 9.8

PrestaShop leocustomajax 1.0 and 1.0.0 are vulnerable to SQL Injection via modules/leocustomajax/leoajax.php.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the PrestaShop application and its underlying database.

Remediation

Apply the latest security patch or upgrade to a patched version of PrestaShop leocustomajax plugin to mitigate the SQL Injection vulnerability.

WeaknessesCWE-89
Authorsmastercho
Template tagscvecve2023prestashopsqlitime-based-sqlileothemevkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:leotheme:leocustomajax:1.0.0:*:*:*:*:prestashop:*:*
Shodan: http.component:"Prestashop"
https://security.friendsofpresta.org/module/2023/06/06/leocustomajax.html https://www.tenable.com/cve/CVE-2023-30150 https://friends-of-presta.github.io/security-advisories/module/2023/06/06/leocustomajax.html https://nvd.nist.gov/vuln/detail/CVE-2023-30150

Source: ProjectDiscovery

References

2