Multiple unspecified vulnerabilities in PrestaShop e-Commerce Solution before 1.1 Beta 2 (aka 1.1.0.1) have unknown impact and attack vectors, related to the (1) bankwire module, (2) cheque module, and other components.

Impact SQL filtering vulnerability, a BO user can write, update and delete in the database, even without having specific rights.

Patches PrestaShop 8.0.4 and 1.7.8.9 will contain the patch.

Workarounds no

References no

Impact ValidateCore::isCleanHTML() method of Prestashop misses hijickable events which can lead to XSS injection, allowed by the presence of pre-setup @keyframes methods.

This XSS which hijacks HTML attributes will be triggered without any interaction of the visitor/administrator which makes it as dangerous as a trivial XSS.

Contrary to most XSS which target HTML attributes and which are triggered without user interaction (such as onload / onerror which suffer from a very limited scope), this one can hijack every HTML element, which increases the danger due to a complete HTML elements scope.

Patches The patch will be on PS 8.0.4 and PS 1.7.8.9

References

In the module "Import/Update Bulk Product from any Csv/Excel File Pro" (baimporter) up to version 1.1.28 from Buy Addons for PrestaShop, a guest can perform SQL injection in affected versions.

An issue in Prestashop v.8.1.7 and before allows a remote attacker to execute arbitrary code via the module upgrade functionality. NOTE: this is disputed by multiple parties, who report that exploitation requires that an attacker be able to hijack network requests made by an admin user (who, by design, is allowed to change the code that is running on the server).

Impact Blind SQLi using Search filters with orderBy and sortOrder parameters

Patches The problem is fixed in 1.7.8.2

PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no known workarounds.

PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to execute arbitrary code via a file upload.

The store system in PrestaShop 1.7.7.0 allows time-based boolean SQL injection via the module=productcomments controller=CommentGrade idproducts[] parameter.

modules/attributewizardpro/fileupload.php in the Attribute Wizard addon 1.6.9 for PrestaShop 1.4.0.1 through 1.6.1.18 allows remote attackers to execute arbitrary code by uploading a .phtml file.

modules/bamegamenu/ajaxphpcode.php in the Responsive Mega Menu (Horizontal+Vertical+Dropdown) Pro module 1.0.32 for PrestaShop 1.5.5.0 through 1.7.2.5 allows remote attackers to execute a SQL Injection through function calls in the code parameter.

modules/bamegamenu/ajaxphpcode.php in the Responsive Mega Menu (Horizontal+Vertical+Dropdown) Pro module 1.0.32 for PrestaShop 1.5.5.0 through 1.7.2.5 allows remote attackers to execute arbitrary PHP code via the code parameter.

Impact Eval injection possible if the shop is vulnerable to an SQL injection.

Patches The problem is fixed in version 1.7.8.7

Workarounds Delete the MySQL Smarty cache feature by removing these lines in the file config/smarty.config.inc.php lines 43-46 (PrestaShop 1.7) or 40-43 (PrestaShop 1.6): php if (Configuration::get('PSSMARTYCACHINGTYPE') == 'mysql') { include PSCLASSDIR.'Smarty/SmartyCacheResourceMysql.php'; $smarty->cachingtype = 'mysql'; }

Impact SQL injection possible in product search field, in BO's product page

Patches 8.1.1

Found by Aleksey Solovev (Positive Technologies)

Workarounds none

References none

Impact Remote code execution through SQL injection and arbitrary file write in back office

Patches 1.7.8.10 8.0.5 8.1.1

Found by Truff (via yeswehack)

Workarounds none

References none

Impact Only PrestaShops with customer-thread feature flag enabled are impacted, starting from PrestaShop 8.1.0.

The impact is substantial, when the customer thread feature flag is enabled, through the front-office contact form, a hacker can upload a malicious file containing an XSS that will be executed when an admin opens the attached file in back office.

Consequence: the script injected can access the session and the security token, which allows it to perform any authenticated action in the scope of the administrator's right.

Patches This vulnerability is patched in 8.1.6.

Workarounds As long as you have not upgraded to 8.1.6, a simple workaround is to disable the customer-thread feature-flag.

Thank you to Ayoub AIT ELMOKHTAR, who discovered this vulnerability and share it with the PrestaShop team.

In the module "Product Catalog (CSV, Excel) Import" (simpleimportproduct) <= 6.7.0 from MyPrestaModules for PrestaShop, a guest can upload files with extensions .php.

Impact In the back office, files can be compromised using path traversal by replaying the import file deletion query with a specified file path, using traversal path.

Patches 8.1.1

Found by Aleksey Solovev (Positive Technologies)

Workarounds none

References none

Impact It is possible to delete files from the server via the CustomerMessage API

Patches 8.1.1

Found by Kto94 (via Yeswehack)

Workarounds none

References none

Impact It is possible to delete a file from the server by using the Attachments controller and the Attachments API.

Patches 8.1.1

Found by Kto94 (via Yeswehack)

Workarounds none

References none

In the module "Generate barcode on invoice / delivery slip" (ecgeneratebarcode) from Ether Creation <= 1.2.0 for PrestaShop, a guest can perform SQL injection.

In the orders section of PrestaShop before 1.7.2.5, an attack is possible after gaining access to a target store with a user role with the rights of at least a Salesman or higher privileges. The attacker can then inject arbitrary PHP objects into the process and abuse an object chain in order to gain Remote Code Execution. This occurs because protection against serialized objects looks for a 0: followed by an integer, but does not consider 0:+ followed by an integer.

Impact When authenticating users PrestaShop preserves session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation.

Patches The problem is fixed in version 8.0.1

PrestaShop before 8.2.9 and 9.2.1 contains an authorization flaw in the Webservice API that allows an attacker holding a key restricted to one shop to act on data of every shop by submitting requests with idshop=all or idshopgroup=N, which expand the shop context without validating the key's actual shop associations and cause shopHasRight() to evaluate the expanded set as a disjunction. Attackers can exploit this flaw via classes/webservice/WebserviceRequest.php to read, modify, or delete data belonging to shops they are not authorized for, including full customer records such as email addresses, securekey, and password hashes across the installation.

PrestaShop before 8.2.9 and 9.2.1 contains a broken access control vulnerability that allows an authenticated Webservice API key holder to read and modify customer records belonging to any shop in a multi-shop installation. Attackers can exploit the missing record-level shop ownership check in shopHasRight() and saveEntityFromXml() to read sensitive customer data such as password hashes and secure keys, and change a customer's email and password via create, update, and delete requests, resulting in account takeover.

Impact displayAjaxEmailHTML method can be used to read any file on the server, potentially even outside of the project if the server is not correctly configured.

This vulnerability can be exacerbated when coupled with CWE-502, which pertains to the Deserialization of Untrusted Data. Such a combination could potentially lead to a Remote Code Execution (RCE) vulnerability

Patches 8.1.1

Found by Aleksey Solovev (Positive Technologies)

Workarounds

References

Impact xss injection through isCleanHTML method

Patches 1.7.8.10 8.0.5 8.1.1

Found by Aleksey Solovev (Positive Technologies)

Workarounds

References

Description Some event attributes are not detected by the isCleanHTML method

Impact Some modules using the isCleanHTML method could be vulnerable to xss

Patches 8.1.3, 1.7.8.11

Workarounds The best workaround is to use the HTMLPurifier library to sanitize html input coming from users. The library is already available as a dependency in the PrestaShop project. Beware though that in legacy object models, fields of HTML type will call isCleanHTML.

Reporters

Reported by Antonio Russo (@Antonio-R1 on GitHub) and Antonio Rocco Spataro (@antoniospataro on GitHub).

Impact Multiple stored Cross-Site Scripting (stored XSS) vulnerabilities in the BO: an attacker who can inject data into the database, via limited back-office access or a previously existing vulnerability, can exploit unprotected variables in back-office templates.

Patches Patched on 8.2.5 and 9.1.0

Workarounds None

References None

Impact It is possible for a user having access to the SQL Manager (Advanced Options -> Database) to arbitrary read any file on the Operating system when using SQL function LOADFILE in a SELECT request. So It can access to critical information.

Patches The patch will be on PS 8.0.4 and PS 1.7.8.9