DΛΣMӨП

// HackTricks · Network Services

PrestaShop

PrestaShop

From XSS to RCE

PrestaXSRF automates cross-site request forgery chains that turn an existing back-office XSS into higher-impact actions on PrestaShop 1.7.x and 8.x. Its PSUploadModule() workflow causes an authenticated administrator’s browser to upload a malicious module, resulting in persistent code execution.[3][4]

ps_checkout ExpressCheckout silent login account takeover (CVE-2025-61922)

Missing identity validation in the ps_checkout Express Checkout flow allows an unauthenticated attacker to switch the current storefront session to a customer account by supplying that customer’s email address. Affected releases are >= 1.3.0, < 4.4.1 and >= 5.0.0, < 5.0.5; versions 4.4.1 and 5.0.5 contain the fix.[1][2]

  • Unauthenticated endpoint: POST /module/ps_checkout/ExpressCheckout.
  • Flow: ExpressCheckout.php accepts attacker JSON, only checks orderID, builds ExpressCheckoutRequest and calls ExpressCheckoutAction::execute().
  • Authentication bug: In vulnerable versions, ExpressCheckoutAction calls CustomerAuthenticationAction::execute() when no customer is logged in. The vulnerable flow effectively performs customerExists(<payer_email>) followed by context->updateCustomer(new Customer($id)), updating the customer context without verifying a password or token.
  • Attacker-controlled email field: order.payer.email_address inside the JSON payload is read by ExpressCheckoutRequest::getPayerEmail().

Exploitation steps

  1. Collect any registered customer email (admin is separate and not affected by this flow).
  2. Send an unauthenticated POST to the controller with orderID plus the victim email in order.payer.email_address.
  3. Capture the returned session cookies. In the demonstrated flow, the customer context is updated even when the endpoint later returns 500, allowing access to the victim’s storefront account. Depending on the data and actions exposed by that shop, this can disclose the customer’s personally identifiable information or permit purchases through payment methods already available to the account.[2]
POST /module/ps_checkout/ExpressCheckout HTTP/1.1
Host: <target>
Content-Type: application/json
Content-Length: 72

{"orderID":"1","order":{"payer":{"email_address":"victim@example.com"}}}

References