PrestaShop leocustomajax - SQLi (CVE-2023-30150)

CVE-2023-30150 is a vulnerability in PrestaShop’s leocustomajax module that enables SQL injection through crafted requests targeting a specific PHP script.

CrowdSec has been tracking this vulnerability and its exploits since 10th of March 2025.

Data from the CrowdSec community indicates that exploitation of CVE-2023-30150 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations. Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2023-30150. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Attackers are sending requests to URLs referencing /modules/leocustomajax/leoajax.php, attempting to exploit SQL injection vulnerabilities within this endpoint.