CVE-2023-50061 is a critical severity (CVSS 9.8) SQL injection in the Opart Easy Redirect module for PrestaShop, versions 1.3.8 through 1.3.12. A guest can reach it on a wide range of URLs. The fix is version 1.3.13, so upgrade the module.
What's affected
The record says Opart Easy Redirect from 1.3.8 up to 1.3.12 is vulnerable, through Oparteasyredirect::hookActionDispatcher(). The Friends of Presta advisory, published 2024-02-08, agrees on the range and lists 1.3.13 as fixed.
The weakness is CWE-89 (SQL injection). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, Critical at 9.8 in both sources.
Fixed version: 1.3.13. The fix wraps request values in PrestaShop's pSQL function. The advisory warns of admin access, data deletion or copying, token exposure and altered SMTP settings.
How to check if you're exposed
In the PrestaShop back office, open Module Manager and find the module by name, then read its version. From a shell you can read the version from the module's main file.
grep -m1 "this->version" modules/oparteasyredirect/oparteasyredirect.php
Look at the pagenotfound table for entries that do not look like ordinary mistyped URLs, which may hint at probing.
If the check shows the module is present at a version in range, treat the shop as exposed whether or not the module is enabled, since some front controllers answer even when the module looks idle. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the open source packages in a manifest against known CVEs. It only sees what you give it, so it will not find a firmware image or a hosted product on its own. Use it for the code you ship and your asset list for everything else.
What to do now
- Find shops using Opart Easy Redirect and read the version.
- Upgrade to 1.3.13 or later.
- Check that custom code uses pSQL consistently for user controlled data.
- Review admin accounts, SMTP settings and the pagenotfound table for unusual entries.
- Upgrade PrestaShop to the latest release and consider OWASP CRS 942 rules on your firewall.
- Turn on audit logging, since standard logs may not show the attack.
Why it matters
The hookActionDispatcher method builds SQL that stores the request URI and HTTP referer in the pagenotfound table. Those values were protected only with htmlentities, which does not make a string safe for SQL. Because the code runs on a wide range of URLs, the advisory says the risk is higher and some firewall allow list patterns may not stop it.
SQL injection is a long standing class of flaw, and it keeps appearing in shop modules because many store owners install third party add ons that nobody reviews. The usual defenses are parameterized queries and strict casting of numeric IDs. The advisory from the PrestaShop security community recommends upgrading PrestaShop itself, which turns off multiple statement queries, though it does not stop attacks that read data with UNION queries. This CVE is not on the CISA KEV list.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does the attacker need an account?
No. The vector shows no privileges and no user interaction. The advisory says a guest can reach the vulnerable code.
Is changing the database prefix enough?
No. The advisory says changing the default ps_ prefix offers little protection against a skilled attacker.
Sources
Last reviewed: 19 October 2026.
