CVE-2023-30839 PoC — PrestaShop vulnerable to SQL filter bypass leading to arbitrary write requests using "SQL Manager"

Source

https://github.com/drkbcn/lblfixer_cve_2023_30839

Associated Vulnerability

Title: PrestaShop vulnerable to SQL filter bypass leading to arbitrary write requests using "SQL Manager" (CVE-2023-30839)
Description:PrestaShop is an Open Source e-commerce web application. Versions prior to 8.0.4 and 1.7.8.9 contain a SQL filtering vulnerability. A BO user can write, update, and delete in the database, even without having specific rights. PrestaShop 8.0.4 and 1.7.8.9 contain a patch for this issue. There are no known workarounds.

Description

PrestaShop <1.7.8.9 Fix for CVE-2023-30839 and CVE-2023-30545

Readme

# LabelGrup Networks, official PrestaShop Partner

![LabelGrup Logo](logo.png)

Module for PrestaShop <1.7.8.9 to fix CVE-2023-30545, CVE-2023-30839 and CVE-2023-30839 vulnerabilities

For further information, check the following links: 
- CVE: https://nvd.nist.gov/vuln/detail/CVE-2023-30545
- CVE: https://nvd.nist.gov/vuln/detail/CVE-2023-30838
- CVE: https://nvd.nist.gov/vuln/detail/CVE-2023-30839

- GitHub: https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-8r4m-5p6p-52rp
- GitHub: https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-p379-cxqh-q822
- GitHub: https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-fh7r-996q-gvcp

**Instructions:**

 1. Download the latest release from this repository.
 2. Install the downloaded ZIP as a normal addon, this will replace/copy the needed files to your current PrestaShop.
 3. Be aware: If you remove the addon, your PrestaShop will be reverted to its original state, exposing the vulnerability again.

Visit our website:
https://www.labelgrup.com

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →