CVE-2023-50027 is a critical severity (CVSS 9.8) SQL injection in the Buy Addons baproductzoommagnifier module for PrestaShop, versions 1.0.16 and earlier. A guest can exploit it without logging in. The advisory says it is used to deploy card skimmers, so upgrade to 1.0.17 and check the shop.
What's affected
The record says versions 1.0.16 and before are affected, through the method BaproductzoommagnifierZoomModuleFrontController::run(). The Friends of Presta advisory, published in December 2023, names the product Best Zoom Magnifier Effect, BAZoom Magnifier, and agrees on the range.
The weakness is CWE-89 (SQL injection). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, rated Critical at 9.8 by both the record and the advisory.
Fixed version: 1.0.17. The fix casts the language and shop ID values to integers instead of inserting raw strings. The advisory also states the flaw is actively used to deploy a web skimmer that steals payment card data.
How to check if you're exposed
In the PrestaShop back office, open Module Manager and find the module by name, then read its version. From a shell you can read the version from the module's main file.
grep -m1 "this->version" modules/baproductzoommagnifier/baproductzoommagnifier.php
Because the advisory links this flaw to card skimmers, look at the pages customers use to pay, and compare file dates in the theme and modules folders with your last deployment.
If the check shows the module is present at a version in range, treat the shop as exposed whether or not the module is enabled, since some front controllers answer even when the module looks idle. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the open source packages in a manifest against known CVEs. It only sees what you give it, so it will not find a firmware image or a hosted product on its own. Use it for the code you ship and your asset list for everything else.
What to do now
- Identify shops running baproductzoommagnifier and read the version.
- Upgrade to 1.0.17 or later, or uninstall the module.
- Check checkout and payment pages for script code you did not add, since the advisory ties this flaw to web skimmers.
- Review admin accounts, modules and database tables for unexpected changes.
- Upgrade PrestaShop to the latest release and turn on audit logging.
- If you find a skimmer, treat card data as exposed and follow your payment provider's incident process.
Why it matters
The module's front controller takes the id_langs request parameter and places it in a SQL query without proper sanitization. A guest without an account can therefore alter the query. The advisory notes that front end logs may show only POST requests to the home page, so audit logs are needed to confirm abuse.
SQL injection is a long standing class of flaw, and it keeps appearing in shop modules because many store owners install third party add ons that nobody reviews. The usual defenses are parameterized queries and strict casting of numeric IDs. The advisory from the PrestaShop security community recommends upgrading PrestaShop itself, which turns off multiple statement queries, though it does not stop attacks that read data with UNION queries. This CVE is not on the CISA KEV list. The advisory's skimmer warning means a patched shop may already be compromised, so patching is the first step and not the last.
Quick check
Does the attacker need an account?
No. The vector shows no privileges and no user interaction. The advisory says a guest can reach the vulnerable code.
Is changing the database prefix enough?
No. The advisory says changing the default ps_ prefix offers little protection against a skilled attacker.
Sources
Last reviewed: 19 October 2026.
