PT-2024-29483 · Unknown · Prestashop

Published 2024-08-12 · Updated 2024-10-09 · CVE-2024-41651

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Prestashop versions 8.1.7 and earlier

Description An issue in Prestashop allows a remote attacker to execute arbitrary code via the module upgrade functionality. However, it is disputed by multiple parties, who report that exploitation requires an attacker to hijack network requests made by an admin user, who is allowed to change the code running on the server by design.

Recommendations For Prestashop versions 8.1.7 and earlier, consider disabling the module upgrade functionality until a patch is available to prevent potential exploitation. Restrict access to the module upgrade feature to minimize the risk of arbitrary code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Code Injection

Weakness Enumeration

CWE-918

CWE-94

Related Identifiers

BIT-PRESTASHOP-2024-41651

CVE-2024-41651

Affected Products

Prestashop

References · 12

• 🔥 https://github.com/Fckroun/CVE-2024-41651/tree/main · Exploit
• https://osv.dev/vulnerability/BIT-prestashop-2024-41651 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41651 · Security Note
• https://osv.dev/vulnerability/CVE-2024-41651 · Vendor Advisory
• https://twitter.com/CVEnew/status/1823049295186010621 · Twitter Post
• https://t.me/cvenotify/96922 · Telegram Post
• https://t.me/cvedetector/2876 · Telegram Post
• https://t.me/cvenotify/97666 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1823064045823369343 · Twitter Post
• https://twitter.com/PorsilapongoCl/status/1823050622792323266 · Twitter Post
• https://twitter.com/Hossted_OSS/status/1825455765110284401 · Twitter Post
• https://t.me/cvenotify/90672 · Telegram Post