Lack of data validation In prestashop/ps_checkout
Description
PrestaShop Checkout Target PayPal merchant account hijacking from backoffice
Impact
Wrong usage of the PHP array_search() allows bypass of validation.
Patches
The problem has been patched in versions:
v4.4.1 for PrestaShop 1.7 (build number: 7.4.4.1)
v4.4.1 for PrestaShop 8 (build number: 8.4.4.1)
v5.0.5 for PrestaShop 1.7 (build number: 7.5.0.5)
v5.0.5 for PrestaShop 8 (build number: 8.5.0.5)
v5.0.5 for PrestaShop 9 (build number: 9.5.0.5)
Read the Versioning policy to learn more about the build number.
Credits
Léo CUNÉAZ reported this issue.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 packagist | 4.4.1, 5.0.5 |
Aliases
1. 2. 3. 4. 5.
References
1.