CVE-2023-50030
CRITICALJms Setting <= 1.1.0 - Unauthenticated SQL Injection via JmsSetting::getSecondImgs()
Title source: llmDescription
In the module "Jms Setting" (jmssetting) from Joommasters for PrestaShop, a guest can perform SQL injection in versions <= 1.1.0. The method `JmsSetting::getSecondImgs()` has a sensitive SQL call that can be executed with a trivial http call and exploited to forge a blind SQL injection.
References (2)
Core 2
Core References
Exploit, Patch, Third Party Advisory
https://security.friendsofpresta.org/modules/2024/01/16/jmssetting.html
Product
https://www.joommasters.com/
Scores
CVSS v3
9.8
EPSS
0.0067
EPSS Percentile
47.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
total
Details
CWE
CWE-89
Status
published
Products (1)
joommasters/jmssetting
< 1.1.0
Published
Jan 19, 2024
Tracked Since
Feb 18, 2026