Matthieu-Rolland

**Name of the Vulnerable Software and Affected Versions** PrestaShop module ps contactinfo versions up to and including 3.3.2 **Description** The ps contactinfo module has a cross-site scripting (XSS) vulnerability. This issue can be exploited in shops that are made vulnerable by third-party modules, such as those vulnerable to SQL injections. For example, if a shop has a third-party module vulnerable to SQL injections, then ps contactinfo might execute a stored cross-site scripting in formatting objects. A commit has been made to prevent formatted addresses from displaying a stored XSS in the database, and the fix is expected to be available in version 3.3.3. **Recommendations** For versions up to and including 3.3.2, apply the fix and keep all modules maintained and updated to prevent exploitation. As a temporary workaround, consider keeping all modules updated and maintained, as no other workarounds are available aside from applying the fix. For version 3.3.3 and later, no action is required as the fix is expected to be included in this version.

**Name of the Vulnerable Software and Affected Versions** blockreassurance versions prior to 5.1.4 **Description** The issue concerns an AJAX function in the blockreassurance module that allows modification of any value in the configuration table, potentially compromising the trustworthiness of a store. **Recommendations** For versions prior to 5.1.4, update to version 5.1.4 to resolve the issue. As a temporary workaround, consider restricting access to the AJAX function in the blockreassurance module until the update is applied.

**Name of the Vulnerable Software and Affected Versions** PrestaShop versions prior to 5.1.4 **Description** The issue affects the blockreassurance module in PrestaShop, which is designed to offer helpful information to reassure customers about the store's trustworthiness. A back-office (BO) user can modify an HTTP request when adding a block in this module, allowing them to specify the path of any file in the project instead of an image. If the block is then deleted from the back-office, the specified file will also be deleted. This could potentially make the website completely unavailable if critical files, such as index.php, are removed. **Recommendations** For PrestaShop versions prior to 5.1.4, update to version 5.1.4 to resolve the issue. As a temporary workaround, consider restricting access to the blockreassurance module to prevent unauthorized file deletion until the update can be applied.

**Name of the Vulnerable Software and Affected Versions** PrestaShop versions prior to 1.7.8.10 PrestaShop versions prior to 8.0.5 PrestaShop versions prior to 8.1.1 **Description** PrestaShop is an open source e-commerce web application. The issue concerns remote code execution through SQL injection and arbitrary file write in the back office. There are no known workarounds. **Recommendations** For versions prior to 1.7.8.10, update to version 1.7.8.10 or later. For versions prior to 8.0.5, update to version 8.0.5 or later. For versions prior to 8.1.1, update to version 8.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** PrestaShop versions prior to 8.0.1 **Description** PrestaShop is an open source e-commerce web application that is vulnerable to cross-site request forgery (CSRF). When authenticating users, PrestaShop preserves session attributes, which does not clear CSRF tokens upon login. This might enable same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. **Recommendations** For versions prior to 8.0.1, update to version 8.0.1 to resolve the issue. As a temporary workaround, consider clearing CSRF tokens upon login to prevent same-site attackers from bypassing the CSRF protection mechanism. Restrict access to sensitive areas of the application to minimize the risk of exploitation.