CVE-2023-50030 is a critical severity (CVSS 9.8) SQL injection in the Joommasters Jms Setting module (jmssetting) for PrestaShop, versions up to 1.1.0. A guest can exploit it with a trivial request. The advisory names no fixed release, so remove the module or apply its patch and review the shop.
What's affected
The record says jmssetting versions 1.1.0 and earlier are affected, through the method JmsSetting::getSecondImgs(). The Friends of Presta advisory, published 2024-01-16, agrees. It rates the flaw Critical at 9.8 and says it can be used to forge a blind SQL injection.
The weakness is CWE-89 (SQL injection). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Fixed version: the advisory names none. It provides a patch against 1.1.0 and recommends upgrading to the latest version. Check with Joommasters for a release newer than 1.1.0. The advisory says the flaw is actively used to deploy a web skimmer that steals credit card data.
How to check if you're exposed
In the PrestaShop back office, open Module Manager and find the module by name, then read its version. From a shell you can read the version from the module's main file.
grep -m1 "this->version" modules/jmssetting/jmssetting.php
Because theme bundled modules are easy to forget, check the themes folder and the module list together.
If the check shows the module is present at a version in range, treat the shop as exposed whether or not the module is enabled, since some front controllers answer even when the module looks idle. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the open source packages in a manifest against known CVEs. It only sees what you give it, so it will not find a firmware image or a hosted product on its own. Use it for the code you ship and your asset list for everything else.
What to do now
- Find shops that use the jmssetting module, often installed with a Joommasters theme.
- Disable or remove the module if the theme does not depend on it.
- Otherwise apply the advisory's patch, which restricts the input to integer IDs, or update to a release that includes it.
- Inspect checkout pages for scripts you did not add, and review admin accounts and database activity.
- Upgrade PrestaShop to the latest release.
- Treat the database prefix change and WAF rules as partial measures only.
Why it matters
The getSecondImgs method builds a SQL WHERE clause by inserting a request parameter directly, without limiting it to numeric IDs. A guest can alter the query. The advisory warns of exposure of customer and payment related data, admin access and deletion of data.
SQL injection is a long standing class of flaw, and it keeps appearing in shop modules because many store owners install third party add ons that nobody reviews. The usual defenses are parameterized queries and strict casting of numeric IDs. The advisory from the PrestaShop security community recommends upgrading PrestaShop itself, which turns off multiple statement queries, though it does not stop attacks that read data with UNION queries. This CVE is not on the CISA KEV list. Theme bundled modules are often missed in asset lists, which is how this kind of flaw stays live for months.
Quick check
Does the attacker need an account?
No. The vector shows no privileges and no user interaction. The advisory says a guest can reach the vulnerable code.
Is changing the database prefix enough?
No. The advisory says changing the default ps_ prefix offers little protection against a skilled attacker.
Sources
Last reviewed: 19 October 2026.
