Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability allows an attacker to inject malicious code into your e-commerce store's backend by submitting a specially crafted email via the public Contact Us form. This code can then be executed when an employee accesses customer service inquiries, potentially leading to unauthorized access and control of your administrative functions.
- Allows takeover of the admin panel.
- Attacker doesn't need an account.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can exploit this by submitting a malicious email address through the public "Contact Us" form. This payload is stored and executes when a back-office employee views the customer's thread, leading to session hijacking and full control of the back office.
- Public contact form is vulnerable.
- Stored payload executes on view.
- Back-office session hijacking is possible.
Live Threat
Current exploitation, exposure, and threat context
Attackers may find this stored XSS vulnerability in PrestaShop attractive because it can lead to full back-office takeover through session hijacking. The ease of exploitation via a public-facing form, requiring no authentication, further increases its appeal. While the vulnerability is fixed, unpatched versions remain a potential target for motivated attackers.
- Exploitable through public form.
- Stored payload, executed on access.
- Unpatched versions remain vulnerable.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize patching PrestaShop instances to versions 8.2.6 or 9.1.1 immediately, as this stored XSS vulnerability in the Customer Service view allows unauthenticated attackers to hijack sessions and take over the back office. If patching is delayed, focus on implementing strict input validation on the public Contact Us form and monitoring back-office customer service threads for suspicious activity.
- Apply patches 8.2.6 or 9.1.1.
- Validate 'Contact Us' form input.
- Monitor back-office threads for anomalies.
