Critical · published May 14, 2024
CVSS calls it critical at 9.7. It sits in the 99.1th percentile for exploit probability.
🚨 A sneaky XSS vulnerability lurks in PrestaShop versions 8.1.0 to 8.1.5, waiting for an unsuspecting admin to open a malicious customer file! 🔥 Think of it as a seemingly innocent package delivered to your front office, but inside is a ticking time bomb that activates when you open it. Just like that package, a simple admin action can unleash chaos! If exploited, an attacker could gain complete control of the administrator’s session, allowing them to execute any action as if they were the admin. This could mean unauthorized access to sensitive data, altering configurations, or even crippling your entire e-commerce operation. The fallout could be absolutely devastating!
Think of it as a seemingly innocent package delivered to your front office, but inside is a ticking time bomb that activates when you open it. Just like that package, a simple admin action can unleash chaos! This XSS vulnerability lets attackers upload a malicious file to the customer thread feature. When an admin opens the file, the injected script runs, compromising session tokens and allowing the attacker to perform actions with admin rights.
If exploited, an attacker could gain complete control of the administrator’s session, allowing them to execute any action as if they were the admin. This could mean unauthorized access to sensitive data, altering configurations, or even crippling your entire e-commerce operation. The fallout could be absolutely devastating! To protect yourself immediately, upgrade your PrestaShop to version 8.1.6, which contains the patch for this issue. If you can't upgrade right away, disable the customer-thread feature flag as a workaround to mitigate the risk. Don't delay—secure your store! You've got this! Follow the steps, and you'll keep your store safe and sound. 🛡️