PrestaShop vulnerable to XSS via customer contact form in FO, through file upload
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
PrestaShop is an open source e-commerce web application. A cross-site scripting (XSS) vulnerability that only affects PrestaShops with customer-thread feature flag enabled is present starting from PrestaShop 8.1.0 and prior to PrestaShop 8.1.6. When the customer thread feature flag is enabled through the front-office contact form, a hacker can upload a malicious file containing an XSS that will be executed when an admin opens the attached file in back office. The script injected can access the session and the security token, which allows it to perform any authenticated action in the scope of the administrator's right. This vulnerability is patched in 8.1.6. A workaround is to disable the customer-thread feature-flag.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| PrestaShop | PrestaShop | 8.1.0 to before 8.1.6 | 8.1.6 | Patch available | CNA |
| — | prestashop/prestashop (Packagist) | 8.1.0 to before 8.1.6 | 8.1.6 | Patch available | GHSA-45vm-3j38-7p78 |
- PrestaShop VendorPrestaShop Affected 8.1.0 to before 8.1.6 Fixed in 8.1.6 Patch available CNA
- prestashop/prestashop (Packagist) Vendor— Affected 8.1.0 to before 8.1.6 Fixed in 8.1.6 Patch available GHSA-45vm-3j38-7p78
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:prestashop:prestashop:*:*:*:*:*:*:*:* | 8.1.0 to before 8.1.6 | Vulnerable | PrestaShop |
- cpe:2.3:a:prestashop:prestashop:*:*:*:*:*:*:*:* Versions 8.1.0 to before 8.1.6 Vulnerable ·PrestaShop
Remediation
- Fix · CNA PrestaShop (PrestaShop) Fixed in 8.1.6
- Fix · GHSA-45vm-3j38-7p78 prestashop/prestashop (Packagist) Fixed in 8.1.6 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-34716
- 2026-10-03 Alias added: GHSA-45vm-3j38-7p78
References
Advisory 2
More Prestashop vulnerabilities
- TI-2024-27717 An issue in Prestashop v.8.1.7 and before allows a remote attacker to execute arbitrary… CVSS 3.1CRITICAL 9.8
- TI-2018-06367 modules/bamegamenu/ajax_phpcode.php in the Responsive Mega Menu… CVSS 3.0CRITICAL 9.8
- TI-2025-19098 A PHAR deserialization vulnerability in the _getHeaders function of PrestaShop v8.2.0… CVSS 3.1MEDIUM 6.5
- TI-2018-13560 PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to… CVSS 3.0CRITICAL 9.8
- TI-2021-02206 The store system in PrestaShop 1.7.7.0 allows time-based boolean SQL injection via the… CVSS 3.1CRITICAL 9.8
- TI-2022-13221 Remote code execution in prestashop CVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-34716 · CVE Program
- CVE-2024-34716 · NVD
- FIRST EPSS
- GHSA-45vm-3j38-7p78 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences