CVE-2023-50028 is a critical severity (CVSS 9.8) SQL injection in the Sliding cart block (blockslidingcart) module from PrestashopModules.eu, all versions up to 2.3.8. A guest can exploit it. The advisory says the author dropped support and no fixed release exists, so remove the module.
What's affected
The record says versions up to 2.3.8 are affected. The Friends of Presta advisory, published 2024-01-16, says all versions up to and including 2.3.8 are impacted and that the author discontinued support, quoting the advice that you must avoid using the module.
The weakness is CWE-89 (SQL injection). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, Critical at 9.8, in both sources. The vulnerable method is Blockslidingcart::renderModal().
Fixed version: none is published. The advisory shows a code change against 2.3.8 that converts a product ID parameter into a list of integers, but does not confirm it as a complete fix.
How to check if you're exposed
In the PrestaShop back office, open Module Manager and find the module by name, then read its version. From a shell you can read the version from the module's main file.
grep -m1 "this->version" modules/blockslidingcart/blockslidingcart.php
Check your web server or firewall logs for suspicious requests that reach the module, but note that ordinary front end logs may not show the attack.
If the check shows the module is present at a version in range, treat the shop as exposed whether or not the module is enabled, since some front controllers answer even when the module looks idle. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the open source packages in a manifest against known CVEs. It only sees what you give it, so it will not find a firmware image or a hosted product on its own. Use it for the code you ship and your asset list for everything else.
What to do now
- Find shops that run blockslidingcart.
- Disable and uninstall the module, then delete its files from the modules folder.
- Replace the feature with a maintained cart module if you need it.
- If you must keep it briefly, apply the advisory's code change and add a web application firewall rule, understanding that neither is confirmed as complete.
- Review admin users, SMTP settings and database tables for unexpected changes, and enable audit logging.
- Upgrade PrestaShop to the latest release.
Why it matters
The renderModal method runs SQL using input that is not neutralized. A guest can send a crafted request to reach it. The sample patch treats the product ID as a list of integers, which is the right idea, but an abandoned module will not get the review a vendor release would.
SQL injection is a long standing class of flaw, and it keeps appearing in shop modules because many store owners install third party add ons that nobody reviews. The usual defenses are parameterized queries and strict casting of numeric IDs. The advisory from the PrestaShop security community recommends upgrading PrestaShop itself, which turns off multiple statement queries, though it does not stop attacks that read data with UNION queries. This CVE is not on the CISA KEV list.
Quick check
Does the attacker need an account?
No. The vector shows no privileges and no user interaction. The advisory says a guest can reach the vulnerable code.
Is changing the database prefix enough?
No. The advisory says changing the default ps_ prefix offers little protection against a skilled attacker.
Sources
Last reviewed: 19 October 2026.
