CVE-2024-34716: PrestaShop vulnerable to XSS via customer contact form in FO, through file upload

First published: Tue May 14 2024(Updated: )

### Impact Only PrestaShops with customer-thread feature flag enabled are impacted, starting from PrestaShop 8.1.0. The impact is substantial, when the customer thread feature flag is enabled, through the front-office contact form, a hacker can upload a malicious file containing an XSS that will be executed when an admin opens the attached file in back office. Consequence: the script injected can access the session and the security token, which allows it to perform any authenticated action in the scope of the administrator's right. ### Patches This vulnerability is patched in 8.1.6. ### Workarounds As long as you have not upgraded to 8.1.6, a simple workaround is to disable the customer-thread feature-flag. Thank you to Ayoub AIT ELMOKHTAR, who discovered this vulnerability and share it with the PrestaShop team.

Credit: security-advisories@github.com security-advisories@github.com

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/weakness
• agent/title
• agent/type
• agent/first-publish-date
• agent/severity
• collector/github-advisory-latest
• source/GitHub
• alias/GHSA-45vm-3j38-7p78
• alias/CVE-2024-34716
• agent/software-canonical-lookup
• agent/references
• agent/softwarecombine
• agent/event
• agent/description
• collector/nvd-cve
• source/NVD
• agent/author
• collector/github-advisory
• collector/epss-latest
• source/FIRST
• agent/epss
• collector/mitre-cve
• source/MITRE
• agent/last-modified-date
• agent/trending
• agent/source
• agent/tags
• collector/nvd-api
• package-manager/composer
• vendor/prestashop
• canonical/prestashop prestashop
• version/prestashop prestashop/8.1.0