PT-2024-25505 · Prestashop · Ja Marketplace

Published 2024-06-19 · Updated 2024-07-03 · CVE-2024-33836

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JA Marketplace module for PrestaShop versions up to 9.0.1

Description The issue allows a guest to upload files with .php extensions, leading to a critical vulnerability. In version 6.X, the method JmarketplaceproductModuleFrontController::init() and in version 8.X, the method JmarketplaceSellerproductModuleFrontController::init() are vulnerable to upload of .php files.

Recommendations For versions up to 9.0.1, consider disabling the JmarketplaceproductModuleFrontController::init() function in version 6.X and the JmarketplaceSellerproductModuleFrontController::init() function in version 8.X as a temporary workaround to prevent the upload of .php files. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-33836

Affected Products

Ja Marketplace

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2024-33836 · Security Note
• https://github.com/friends-of-presta/security-advisories/blob/main/_posts/2024-06-18-jamarketplace.md · Note
• https://t.me/cvenotify/83783 · Telegram Post