Cyber Resilience

CVE-2023-30149

CriticalPublic PoC

Published: 02 June 2023

Published
02 June 2023
Modified
31 January 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0817 92.4th percentile
Risk Priority 25 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-30149 is a critical-severity SQL Injection (CWE-89) vulnerability in Prestashop Prestashop. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 7.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

The vulnerability is an SQL injection flaw (CWE-89) in the City Autocomplete (cityautocomplete) module by ebewe.net for PrestaShop. It affects versions prior to 1.8.12 on PrestaShop 1.5/1.6 and prior to 2.0.3 on PrestaShop 1.7, and is reachable through the type, input_name, or q parameters in the autocompletion.php front controller. The issue carries a CVSS 3.1 score of 9.8.

Remote, unauthenticated attackers can supply crafted input to these parameters and execute arbitrary SQL commands against the underlying database, resulting in full confidentiality, integrity, and availability impact on the affected PrestaShop installation.

Public advisories from Friends-of-Presta and the PrestaShop add-on marketplace recommend updating the cityautocomplete module to the fixed releases noted above; the module pages also host the patched versions for download.

EPSS reached a peak of 0.1173 on 2026-02-25 before receding to the current value of 0.0817.

EU & UK References

Vulnerability details

SQL injection vulnerability in the City Autocomplete (cityautocomplete) module from ebewe.net for PrestaShop, prior to version 1.8.12 (for PrestaShop version 1.5/1.6) or prior to 2.0.3 (for PrestaShop version 1.7), allows remote attackers to execute arbitrary SQL commands via the type,…

more

input_name. or q parameter in the autocompletion.php front controller.

CWE(s)
CWE-89

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

ebewe
city autocomplete
≤ 1.8.12 · ≤ 2.0.3

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CA-8 Penetration Testing
addresses: CWE-89

Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.

SI-10 Information Input Validation
addresses: CWE-89

Validates query inputs to prevent SQL syntax or command manipulation.

References