VU#385711: PrestaShop Performance Debug Configuration Contains a PHP Code Injection Vulnerability
Overview PrestaShop's back-office Performance > Debug mode functionality contains a PHP code injection vulnerability. An authenticated attacker with permission to modify debug-mode configuration can submit crafted cookie configuration values that are written into an executable PHP configuration file. Successful exploitation could allow arbitrary code execution with the privileges of the PHP process. Description PrestaShop is an open-source e-commerce platform for creating and managing online stores. Its back-office Performance configuration includes a Debug mode for developers, which is enabled based on a specified cookie name and value. PrestaShop's debug-mode configuration code inserts the user-controlled values debug_cookie_name and debug_cookie_value into a PHP expression without adequately escaping or sanitizing them for use in PHP source code. The application writes this expression into the PHP define() statement in config/defines.inc.php or config/defines_custom.inc.php . A craf
Continue on CERT/CC Vulnerability Notes ↗ ‹ All news Get the newsletter