CVE-2023-30194
Published: 10 May 2023
Summary
CVE-2023-30194 is a critical-severity SQL Injection (CWE-89) vulnerability in Prestashop Poststaticfooter. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 1.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Prestashop posstaticfooter module versions 1.0.0 and earlier contain a SQL injection vulnerability in the posstaticfooter::getPosCurrentHook() method, tracked as CVE-2023-30194 with a CVSS 3.1 score of 9.8 and mapped to CWE-89. The flaw affects the Prestashop e-commerce platform when this module is installed and enabled.
An unauthenticated remote attacker can supply crafted input over the network to trigger the injection, resulting in full read, write, and delete access to the underlying database and potential takeover of the Prestashop instance. No user interaction or credentials are required for exploitation.
The EPSS score for this CVE reached a peak of 0.7652 on 2026-03-09 before receding to the current value of 0.6673, indicating a material rise in exploitation interest well after the May 2023 disclosure. Public advisories are available from Friends-of-Presta and the module author Posthemes on ThemeForest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-34619
Vulnerability details
Prestashop posstaticfooter <= 1.0.0 is vulnerable to SQL Injection via posstaticfooter::getPosCurrentHook().
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.