PT-2024-26130 · Unknown · Prestashop

Aelmokhtar · Published 2024-05-14 · Updated 2025-02-20 · CVE-2024-34716

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PrestaShop versions 8.1.0 through 8.1.5

Description A cross-site scripting (XSS) vulnerability is present in PrestaShop when the customer-thread feature flag is enabled. This allows a hacker to upload a malicious file containing an XSS that will be executed when an admin opens the attached file in the back office. The injected script can access the session and the security token, enabling it to perform any authenticated action within the administrator's rights. Over 300,000 results have been found to be potentially affected.

Recommendations For PrestaShop versions 8.1.0 through 8.1.5, update to version 8.1.6 to resolve the issue. As a temporary workaround, consider disabling the customer-thread feature-flag until a patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-01960

BIT-PRESTASHOP-2024-34716

CVE-2024-34716

GHSA-45VM-3J38-7P78

Affected Products

Prestashop

References · 26

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34716.json · Exploit
• 🔥 https://github.com/aelmokhtar/CVE-2024-34716 · Exploit
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-45vm-3j38-7p78 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34716 · Security Note
• https://bdu.fstec.ru/vul/2025-01960 · Security Note
• https://osv.dev/vulnerability/GHSA-45vm-3j38-7p78 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-34716 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-prestashop-2024-34716 · Vendor Advisory
• https://github.com/PrestaShop/PrestaShop · Note
• https://github.com/PrestaShop/PrestaShop/releases/tag/8.1.6 · Note
• https://github.com/PrestaShop/PrestaShop/commit/a248898655e56cbcc6c308a5f1c8752231624bae · Note
• https://twitter.com/fofabot/status/1791290395542048988 · Twitter Post
• https://twitter.com/David_Uton/status/1885712275488535016 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1791286901514920179 · Twitter Post
• https://t.me/cybersecuritytechnologies/11776 · Telegram Post