PT-2025-42516 · Prestashop · Prestashop Checkout

Inem0O · Published 2025-10-16 · Updated 2025-12-29 · CVE-2025-61924

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PrestaShop Checkout versions prior to 4.4.1 and 5.0.5

Description A flaw exists in the PrestaShop Checkout module due to incorrect use of the PHP array search() function. This improper usage allows bypassing validation, potentially leading to the hijacking of the Target PayPal merchant account from the backoffice.

Recommendations Update to PrestaShop Checkout version 4.4.1 for PrestaShop 1.7 and 8. Update to PrestaShop Checkout version 5.0.5 for PrestaShop 1.7, 8, and 9.

Exploit

Fix

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-184

Related Identifiers

CVE-2025-61924

GHSA-WVPG-4WRH-5889

Affected Products

Prestashop Checkout

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61924.json · Exploit
• https://github.com/PrestaShopCorp/ps_checkout/security/advisories/GHSA-wvpg-4wrh-5889 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-61924 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61924 · Security Note
• https://osv.dev/vulnerability/GHSA-wvpg-4wrh-5889 · Vendor Advisory
• https://github.com/PrestaShopCorp/ps_checkout · Note
• https://twitter.com/CVEnew/status/1978926572305260888 · Twitter Post
• https://t.me/cveNotify/147078 · Telegram Post
• https://t.me/CVEtracker/35130 · Telegram Post
• https://t.me/cveNotify/147063 · Telegram Post